With the National Cyber Warrior Academy at the University of North Georgia, we're learning a little
bit about car hacking.
So over the weekend, we learned that a car, an automobile, has a controller area network, a Khan
network that runs well throughout your entire car.
But it allows you to utilize network sniffing tools like we've seen Wireshark and a couple of other
sniffers to capture the network information that says what's going on in your car, whether that's your
blinkers, your car stereo, your air conditioning, your accelerator, your brakes, your door locks,
we can see all those things and we can tap into the network with just a USB cord and a cable that you
can buy for 20 to 40 bucks on Amazon called a can to USB and has an onboard diagnostic port that plugs
in under the steering wheel.
So what I'm going to do with five of our mentors today is actually take a little time to show them how
to connect to my car.
This is my actual twenty seven Volkswagen Jetta, and we're going to listen to some of the signals coming
out of our onboard diagnostic port through a simple dashboard program that we've set up.
So you can see things like fuel economy and how well the tachometer are just about everything from the
dashboard.
So know what you want to give the first shot.
All you need to do is first plug this into the laptop and make sure we get a yellow light on there.
So and then, Sean, I'll show you where to plug it into the onboard diagnostic port.
Yep.
So what we're doing is first making sure that we're connecting from the computer to the tool, the cable
and make sure we get a yellow light on the underside of the cable there.
Good.
All right, John, you want to step up under here with NOAA and run at the base of the steering wheel?
On the left side, on the left over here, closer to the door here, you should see a purple port on
my car.
Looks like a really big cereal cable.
And that's the onboard diagnostic port.
It's the same thing that a mechanic plugs into when they want to read one of the codes from your car
and you just work that in it, feel like it goes in very far.
But that's perfect.
And then you should see the underside of that light turn green if you can look up under there.
We're good.
All right.
Now that that's happened, we can turn on the vehicle.
I'm actually I'm going to hand this off, Boaz, so I'll let you turn on the car.
So pretty good.
It's it's an automatic.
So it shouldn't take off without you.
The parking brakes on the streets over there and.
Yeah, no, they're good.
So let's remind the folks watching here that this is not intended to be a how to video.
Don't try this at home.
You do need the foot on the brake.
There you go.
All right.
And you can hear you can hear the diesel engine start to purr.
But you can also see on the front screen here, you can see the tachometer is now lit up and we have
the miles per gallon, the fuel economy, how much we're consuming right now.
And if you will, give it just a little bit of gas.
But let's keep it steady a little higher.
We'll see that tank move up just a bit.
Oh, wait.
We got to reconnect.
All right.
So let's see, Isha, you haven't had a chance to run going on here.
We're going to reconnect it lost that connection.
So we're going to do an action right here.
And if you click the Connect button right there.
Good.
And what it's doing now is just running through several different protocols for different types of cars,
European cars are slightly different from Japanese makes and models.
Right.
So it's going through several different.
And it's found one one of the European protocols, it's reading the vehicle information because it's
a little German car, Volkswagen, and it will now.
Yeah, there we go.
We should get a live feed.
Actually know.
No, you want to give it just a little bit of gas.
Just rev it up a little bit.
Thanks, Bill.
Appreciate it.
And there you see the tachometer move.
Go and take it up to 2000 and keep it up around two thousand for a while.
There we go so we can see the readout.
You'll notice that my fuel economy is going way down because we're sitting still and running the engine,
but we're getting information on the load, on the engine.
So if you go back to inital, you see that comes back.
There we go.
And we steady off.
We've got the engine temperature.
Still pretty cool because we just now turned it on, of course.
So we are actually reading from the controller area network of this car into our laptop now and this
laptop.
We have just a very simple dashboard type interface.
But what we learned how to do over the weekend was set up a virtual controller area network, a simulated
car network on the laptop.
Then we can record those signals as we make changes.
So if we turn on the blinker, we can see it flashing on the dashboard indicator.
If we rev up the engine, in fact, I think we hacked it and we could go up to two hundred and sixty
or two hundred eighty miles per hour, our engine, our virtual car.
Then we can unlock the doors, locked the doors while it's moving.
Then you record that you capture those network packets and you can actually replay it on the same network.
So what we saw video of was a couple of guys doing exactly this, except they were controlling the car,
turning the steering wheel, turning on the audio, turning it on the stereo.
I think they turned on an air conditioner blaster to a couple of other things.
They were doing well, unfortunately, they ran out off the road and into a ditch.
I believe we did not do that here locally.
We just watched a couple of videos, but the same principles apply.
Once you can capture the network signal, you can use what we call a replay attack, where you take
that same network signal that was triggered when you turn on the blinker, turn on the stereo, hit
the brakes and replay it on a car network and you can have the same effect.
I'm sorry, Doctor, can we have someone who's watching right now?
Here's the question.
What's your software used on the computer?
We were using some open source software from open garages, dawg.
You can go to Open Garages Dog and has a link to the I see sim, I see Capital I Capital C Sym or the
I see simulator.
And it allows you to simulate that controller area network to record things, use a package called Can
Sniffer.
So it sniffs that controller area network and it allows you to record that network traffic and then
can player allows you to play it back.
The can utilize on most new Linux distributions, Debian, Linux, like the Caleigh Linux that we're
using.
You can download everything for free, install it on your own computer and buy one of these cables on
Amazon or any place that sells a can to USB connector and you're able to connect into your real car
and listen to the same signals.
And what would be the advantage for someone wanting to do this on their own vehicle?
Oh, absolutely.
There are two things, really.
First of all, you can just work on your own vehicle.
And it used to be in the old days we would buy a car and we could maintain it ourselves.
Nowadays, we usually have to take it into a garage to even figure out what the problem with it is.
We just get a dashboard indicator.
The cool thing about these onboard diagnostic tools that we can plug into a regular laptop using open
source software and read the code ourselves.
And we still may need some help figuring out what to do with it after that.
The second thing that you can do is check your car for security.
In fact, in one of the videos we saw this weekend, they were able to hack in to the controller area
network through the onboard entertainment system.
So they were connecting in through a cell phone call and hacking a Jeep Grand Cherokee.
You may have seen on the news a few years ago.
What we're hoping to do is get these tools and more people's hands so they can check the security of
their own vehicles.
Plus, of course, we have a number of students who go on to work for the car companies.
We have Giammetti just a few miles south of campus here down in Roswell, in Alpharetta.
So we produce students who have at least seen a little bit of this and have a chance to take it into
the work world.
Thanks for the question.
Sure.
What what kind of skills are the students who are here at the Cyber Warriors Academy?
What kind of skills do they learn from being able to do this or can learn more about car hack?
OK, well, let's see.
First of all, we learned a lot about Kelly Linux, right, guys?
So we learned a lot of command line tools, a lot of open source software tools that people can download
and install on their own computers.
We learned how to use some particular tools for penetration testing or testing the security of a system
like misplayed their attacks that you can use to break into a Windows machine, you can break into a
Samsung television, anything with a computer in it.
These days, there are exploits for cell phones included.
So the students are getting a chance to see how to do that.
We even worked with drones a little bit.
They got a chance to go down to Fort Gordon yesterday to see some live hacking and coding sessions right
there at the Army Cyber Center of Excellence and also the exposure to this class.
Oh, absolutely.
Rose Proctor came over and gave us a good dose of ethics before we started the ethical hacking course,
so that was a great way to kick things off.
We learned about how to do these things with permission on the systems that you own or for companies
that are interested in increasing their security.
We never use hacking tools without permission.
That makes us a bad hacker.
But you need to know what tactics correct hackers are using so that you can defeat the bad hackers.
Exactly.
And we're learning how to hack into things like web applications.
And then we show how to strengthen Web applications so no one can hack into your site where your business
inside you mentioned, drowns there a chance that we might could see some drones in action actually
right behind us.
Sure.
We go when caught in the wind there.
But there we go.
We can see a group of students controlling the drone using just a regular cell phone.
Now, these are some of our smaller drones.
This is a mini cargo.
It'll actually carry some Legos.
And it's fighting a pretty strong headwind, but doing a really good job for a small drone.
We also have larger drones that are FAA registered, anything over eight ounces.
We register with the Federal Aviation Administration and we keep them under four hundred feet.
Some of the good guidelines for using drones and we usually don't fly them directly at students, for
example, can we perhaps maybe walk over here without being drowned?
Oh, sure.
Absolutely.
You guys mind if we get a little closer to the drone action?
She's doing the the Facebook line.
You guys are streaming in real time.
There you go.
You want to double tap the screen, make a big one flip if we can get one in, just
maybe too strong into the wind, allow that to happen there.
Oh, there we go.
All right.
Even in a heavy headwind.
Great job.
All right.
So you can see the students have had a chance to touch lots of different types of technology.
Computers are in everything that we use these days, from toys to agricultural and industrial drones
to our cars, to your Fitbit, you name it, just about everything.
All right.
And a safe landing.
Just about everything has a computer in it these days.
So we need people who are thinking about securing these devices that come into our homes, our businesses
and the world around us.
Perhaps one of our students here like to talk to us about what they've learned so far.
Could we could we get a volunteer who'd like to talk about what they've learned?
One of the mentors.
You guys want to share anything?
Sure.
Because it's a learning experience for them.
Absolutely.
Well, let me tell you a little bit about our mentors.
We'll turn back around this way.
We have four of our students here at the University of Georgia and our fifth mentor right over there
who's actually leading the drone activities.
They've been participating during the entire coding, hacking and all the drone and other activities.
In fact, they facilitated evening activities, team building with these devices.
And so they've been picking up some skills along the way.
I'll start over here with Sean Dekel.
So make your way and share a couple of things that you found interesting about.
All right.
I'm Shawn Dekle.
I'm an information systems major here, minor in cybersecurity.
I'm entering my senior year at the University of North Georgia and Corps cadets and have some interesting
things I've learned here is just how to secure a computer using the command prompt, just knowing where
your signals are going and how they're being traced.
And that's information I didn't know prior to.
So I think I can develop my skills even further and just see what more I can do with a command from
pass it over to coming up next.
Hello, my name is Aisha and I'm a sergeant major here.
And I like this camp because I get to learn more about, like, how to secure my computer and just basically
learning everything and what some of these kids can actually do for the interest.
And to me and I hope to learn some more at the end of this camp.
Right.
I'm Boaz Cradock, the engineer information systems major, but now a little minor in cybersecurity.
Hopefully after this, how this game is really piqued my interest for a number of reasons.
First off, I got a lot to work with high school students, and I never thought I'd realize that I really
wanted to do something like this that we're doing here, which is like learning how to, like, protect
yourself from all the Big Brother stuff that we've been talking about.
And that is always a big scare.
It's been a scare since, like anybody else, they came out with a Smith like 1998.
So, I mean, just like learning how different like AI programs are, say like you have Linux or Mac,
Linux or Mac or Windows boxes.
How they actually even work at the base level requires.
That's not exactly what we're going to learn here.
But I've been doing my own research outside of it and trying to catch up to some of our students.
High level of hacking, understanding and interacting with the high schoolers who actually do have a
high knowledge of it has really sped up my learning process.
So it's.
I get that opportunity, they just have face to face contact with people who have done some ethical
hacking in the past.
So that's not my friend.
No, I'm no aware.
I'm an information systems major I'm sorry, my sophomore year and the minor cyber security I've learned
anyway.
So I helped to, like, protect my own computer and stuff.
And I've learned how everything on the Internet and things are like vulnerable to, like hacking.
And I didn't realize I was such a big problem.
But I've learned many ways to, like, help defend for that.
And I've learned so much about computers and networking in so many different systems.
And I learned so much from the students to use outside the classroom.
It's been really great working with them in here.
When we come over to pick the students, if we can get some volunteers there.
Yes.
So we're going to go talk with some of our campers.
And but if you are watching out there and you have any questions about cyber security or computers,
I mean, this is the group to ask if you've got questions.
They're the ones who will be able to answer those questions, you guys, to a little bit about what
they've been learning or something that's been interesting so far.
Facebook like introduce yourself.
Tell me how you tell us where you're from.
I'm not sick.
I'm from Suwannee, Georgia.
And some of the things we've been learning, learning is like being able to, like, sniff packets that
have passwords in them and like be able to stop phishing attacks, scanning networks, doing like network
scans, things like that.
That's what we've been learning.
What school do you go?
Do I go to Laimbeer High School and that's in Swannie?
Yes.
What made you want to come to this campus?
I saw the headline that it was like a cyber security camp, and that's something I've had an interest
in for a long time.
So I just decided I should give it a shot, see if I get in here I am.
And I'm enjoying my stay.
Thank you so someone else, what have you learned?
Sure, I'd like you.
Yeah, I'm going to go live in mid air.
Yeah, that was me.
He was under no pressure.
He was on Facebook like he did it.
So talk a little bit about what you've learned.
So this camp has kind of exposed me to many other hacking tools.
And I've learned a lot about how to code in different languages such as Python and JavaScript.
And it's a real learning experience for kids who are trying to go into the cybersecurity field, computer
science field, or just anyone that's trying to learn.
I've learned a lot and it's only been five days right now.
Yeah.
So it's awesome.
It's such a great camp and I'm really liking it.
Where are you from?
I'm from Chicago.
I flew here from L.A..
Yeah, you came here.
So what drew you to this camp all the way up in Chicago?
How did you learn about the people?
So I was actually talking to Dr. Payne, too, and he kind of introduced me to this camp.
So it was just a real like I saw.
And I was like, oh, I really want to do this.
And I was already kind of looking to research more about computer security and cyber security.
So this is kind of opened my eyes to what the field looks like.
And I'm really excited for the future.
And the drone is buzzing right beside you kept looking, looking toward.
He's keeping his eye on the door.
Yeah.
I don't want to get hit by the drone.
Yeah, well, thank you for thank you for sharing.
Yeah.
Thank you.
So shout out to Chicago out there if you're watching.
Now we have a total of 40 students here, 20 male, 20 female students their entire time here is funded
by a grant we got from the NSA and the National Science Foundation of Peace for their books, the room,
their tuition.
Well, everything they cover while they're here is 100 percent paid for because the NSA really believes
in exposing young men and young women to the kinds of things that we need to know out in the cyber workforce.
And we had 36.
That is the National Security Agency.
That's correct.
That's one of those federal three labor.
Absolutely.
And they're funding around 130 camps nationwide.
We were very fortunate to have our second camp this year.
We began this last year and these students stay on campus for 10 days and get ethical hacking, curricular
training, just like you would if you're going to a certified ethical hacker boot camp out in industry.
And I guess what's going to show up and again, if you're watching out there, you have questions.
Like I said, these are the people to ask, A, if I might be talking about some of the cybersecurity
programs, technology programs we offer here, or we do hope to see a good number of these students
enter either a Bachelor of Science and computer science program with a concentration in information,
assurance and security.
The short way we say that is the best.
And yes, with cyber, we are also working.
We have a new graduate certificate in cyber for those people who might be coming back, either changing
careers or wanting some training mid career or coming straight out of a bachelor's program and want
to pick up some graduate certification in cybersecurity, you'll get a chance to see computer security,
network security forensics and a couple of electric fields in there.
But we've been designated by the National Security Agency and the Department of Homeland Security last
year as a center of academic excellence in cyber defense.
And so any of our programs come with a seal from the Department of Homeland Security and the National
Security Agency.
So just give students a little extra credential before they go out into the work world.