elfy: I need to take my notes out first.
You see it's very Chaos style here because my LibreOffice decided
to kill my presentations today when I pasted stuff into it and
so we have to do a little bit of freestyle but here we are.
Thanks for coming, thanks for the warm welcome
and I think we are gonna have a bit of fun here.
A bit of sarcastic fun. It's actually not that fun but we can make fun
out of things that should be fun and I will now have my notes opened and then
we can just start. Where is the window? Now! So I'm using a wheelchair from time to time
especially at events like this and I got some hardware for this. It's paid by the
German Krankenkasse and it's actually really decent hardware because it's doing
its job and it's working really conveniently and nice so it's similar to an
e -bike which has just support power so it doesn't just doesn't try and drive on
their own but I also have a model which can also drive on their own and so I can
also hands -free drive like a hill way up or other parts of a day where I need the
energy I can use the full driving feature and yeah it's really nice
hardware I really like it and it does what it's supposed to do and yeah it's
it's a good stuff for when it's needed. I see my slides are still a bit messed up
but now we are complete good and when I got this drive in 2023 I even paid 3000
euros more for the self -driving variant because the insurance wasn't going to
cover this so I said after six months of discussing with them and getting my my
application through at them that they are covering the costs they said we'll cover
the basic variant and then I said yeah I will just pay the 3000 euro out of my
own pocket because it's either way I can do back and forth writing with the
manufacturer or with the insurer for six months or I can just have my peace and
give them my money and have my piece with it. The drive itself like I said it's
good it's got two drive modes mainly one is for more outdoors and has longer
ranges when I push the wheelchair the other mode is more for indoors. And for
switching those modes the manufacturer sells a remote and this is one of two
remotes I show today and to just depict the absurdity but this is one remote not
really much hardware on it we will talk about it later and there's also a second
remote which is used for the self -driving feature so this remote can be used for
self -driving it can be turned and then wheelchair moves forward and yeah I got this
wheelchair drive in 2023 and I read the manuals a bit and there were signs of hey
you can use an app for their features, so I downloaded it and there were some
surprises and the surprise was we have DRM features for you you can buy for 300
euro features like going faster than six kilometers per hour replacing this remote
with a software remote in the app of the manufacturer and yeah that was really
really weird I would say and then I clicked in the app and found there's an
dealer mode access it's for dealers apparently not for the peasants who want
to configure their wheelchair drive it's for dealers and yeah they can adjust the
settings of the drive like the driving behavior how far it should roll with one
push and it had one of the features that cost 99 euro as DRM feature
the switching between two modes it was just there an d this started the whole thing and
hundreds of hours of hexadecimals and other stuff
because apparently it's just a software problem or
software enforcement that there's a paying feature
to get to user interface which can toggle between
assist mode one and assist mode two and also there is
apparently the dealer mode who can do this without paying
you have to know the password it wasn't hidden very well the password was in some PDFs
on the internet just for plausible denability but I got the
password in clear text from the Android app and yeah this is some
something that will we will encounter several times this talk
the secret management stuff of them and yeah so I thought
what shall we do with this device and I think we at Chaos
know what to do with such devices we take a look inside
and we take a look inside at the software at the hardware and we want to have “Spaß am Gerät”
and to maybe also the assistive device that's a part
of my life can also have funny quirks or Spaß am Gerät
and this was in 2024 so yeah I've been having a
lot of fun since then and yeah welcome to Pwn2Roll
now I have to get to the next slide
so first of all money money money the catalog hardware just to give you an overview
how much this thing I'm sitting on costs and parts because this is only the drive
the drive i s two wheels that get swapped and I can use them so my previous
wheelchair remained but this was because of the drive itself and yeah the drive
itself is the biggest part but there's also another list of other options you need
because without this remote or without the in -app purchase you cannot switch between
mode one, assist mode one and two. Assist mode one is really really slow it's for indoors
and I tried assist mode once outside and on a
climb at a hill it's it really sucks it's not fun
but you need this button to change it to two or you need 99 euros
you throw it at the company via in -app purchase to switch those modes
and the insurance luckily covered this for me and they
covered many of these parts that are in this calculations
but they also did not cover the self -driving variant which
then resulted into me paying around 3000 euros. next slide
when we go to the software in -app purchase there's a speed unlock for 99 euro
which increases the maximum speed of a drive
from six kilometers per hour to eight and a half
and there's a remote control feature I already talked about there's
cruise mode which is you can make the wheelchair go by itself
you set a this not a distance you set a speed and
when you go forward and you can just go hands -free
and there's a parking mode which is really funny because you can
just see around your wheelchair when you're not sitting in it
so maybe for holding Tschunk at the bar and there's
a push counter I don't know who needs a push counter
it's there it costs 9 euro 99 and in sum it's 349. 95 but the
dealer is really generous and says you can just buy it all for 300
to have all these shiny features yeah this was very fun to
discover and because the insurance is paying for this remote
but when I don't want to carry this remote around I need to pay
the manufacturer so the manufacturer gets money from everyone
so it's a really good business model apparently and yeah
it's just really really wild. DRM in medical devices is
not a good thing in my opinion and that's because,
that was because I started this thing here.
good. and yeah. I can go on. We also got other products and
they were sort of the pioneers of DRM in wheelchairs I think
they started 2014 it's a bit of the predecessor of my wheelchair
drive they discontinued it in 2022 I think it wasn't really
big in Germany but there were some adverse events which
need to be reported to FDA and they started 2014 with
hey you can give us 390 euro you can go faster you have
some convenience features in the app and they do it also
with other products they have VP15 is a is a pulling
cart for your wheelchair you can also buy a speed upgrade
the e -Fix is also with a speed upgrade you can buy the
mobility plus package and there's also another the smoov O10
which is I think the newest of the product lineup but also
has paper payment features for stuff that's apparently there
yeah good so just to give you an overview on this and yeah prices and stuffs and
this is how the remote looks like in the app not
very shiny stuff this is it again but yeah. I just
missed I think I just missed a photo here but I can
look it up we do it interactively now, one moment.
Yeah this was what we saw earlier and this is the
dealer mode with a bit more configuration options
and one can here just toggle assist mode one or two
and just to show you this is like it is you just have
to have the password from the internet you can type
it there and at least some parts of the remote control
are not there anymore and not needed to be bought but yeah. so
we all know how that goes , we have bluetooth in my wheelchair.
We have in -app purchases in my wheelchair and I think
this is a situation like this starts good things
I think and it also starts a lot of late nights and weekends staring at really weird stuff.
Mainly decompiled stuff. S o this is the wrong picture um it's not good but I can look it up.
Those are my angel shifts maybe not here yeah but that's
another letter that's that's not what I'm looking for
I looked into really really much uh things um and read
really really annoying and boring documents so you
don't have to in 2020 there was a um security issue in most protocol stacks of bluetooth and
um and the FDA um wow the Americans do good things the
FDA required the people to or companies to report if their
products are vulnerable or affected by these um uh by
these uh security issues this is some general letter they
they um they sent out to manufacturers with medical
devices because Alber is also selling in the USA and
I'm really bad at finding the letter now I had it
previously but here we go blah blah blah blah blah blah
blah blah cyber security assessment mitigation
including SweynTooth vulnerabilities evaluation
I will just move this to the other screen so you
can also enjoy some paper yeah so this was the
response from the manufacturer to the FDA telling
manufacturers of medical devices to report how
are you affected by this vulnerability how did you
fix it and there are some money quotes in this um
the biggest one is in the uh second part these
vulnerabilities so this is the answer of Alber the
company uh to the FDA these vulnerabilities cannot be
exploited remotely and all of these attacks require
that the bluetooth that blue that the device bluetooth
is enabled and that the attacker is within close
physical proximity, i.e., within bluetooth range of the device
I think they described how bluetooth works
and they prevented uh they made preventive actions to avoid harm
all wireless communications is encrypted um
yeah that's not the thing at SweynTooth it's a link layer attack so
uh yeah the FDA apparently they got away with this at the FDA
but since then uh they they have in their manuals
uh this explanation like like um down there
yeah the wheelchair just stops um and if someone is attacking you they really
they even write SweynTooth in their manual because they never patched it away
there are patches for the bluetooth modules but the
bluetooth module in my drive is broadcasting happily
version 1.00 from the manufacturer which is from
2016 and there are patches they just didn't patch it
and they just do yeah the risk is maybe your
drive stops working when you are going uphill or
uh I don't know where and then it's totally safe
because it only stops and uh case closed a bit and
that's just to tell you how they uh how the
manufacturer is a bit in terms of dealing with security
and uh yeah we see they uh a bit of I don't know if
they lied with this um but it's I don't know if the FDA
doesn't know that the mitigation won't work because
it's really a hardware link layer attack and not
on the transport which they encrypt and yeah they
got away with this but um yeah that's the thing and
I'm using this drive with this problem and the other
big thing is how they handle security and secrets
management is um as you saw um the traffic is encrypted
and what do we need for encryption we need keys
and we need falling radio devices and uh we need keys and how do we get a key
uh to be uh you have to distribute the key uh and
also for further you reuse and I can show you where
the key would be it's taped over here for reasons but
the um AES key for each wheel is a QR code printed
on the wheels hub yeah um that's what I thought um
and with this key one can completely overtake the
wheelchair and the money quote is they call it the
cyber security key so the thing is anyone with a
camera can come back next to me and take a photo and really over wireless bluetooth you can
take over the wheelchair drive you can limit it
to two kilometers per hour you can wipe the entire
firmware you can do everything you have full access and yeah that's the concept of security
and I think they would also respond in the same way
like in the FDA letter one has to be in proximity
to scan the QR code and yeah luckily it seems to
be changeable so when people know that the key
has been stolen from their magic wheelchair hub
it can be changed I did not test but it's in the
a maintenance application of the manufacturer so
how does the QR code get to an AES key the QR code
content is a 22 long string and we have a custom 64
character alphabet with mappings and each character
maps to six bits and 22 characters times six equals 132
for AES 128 you need 128 long keys so what you do you
drop the first four bits that's the key the entire
security of the device so yeah if someone has this key
it's game over and I think that's a design choice
they made it's not they are very very upfront with it
to yeah in manual state yeah just scan this key
to pair the manufacturer training videos show it
also the maintenance application shows it so
it's yeah it's I think it's they know about this
and said it's okay the beautiful part of this is the
crypto is actually okay it's AES 128 CBC they use ECB too
which is a bit weird but it's another topic they
just use standard libraries so at least they did not
build their own crypto there but I think um the crypto team and the key distribution team
should maybe met someday because they are just
yeah they're doing it and they are shipping out
devices like this all the time and these devices are
quite popular I already saw on this congress I think
two or three different beside of mine so yeah don't scan people's QR codes on apps please
uh because you may cause harm good so I already said
bluetooth is not deactivated you cannot deactivate
the bluetooth never it you have to unsolder the
bluetooth module from the um from the drive itself
one could patch it I did not try but it's it seems
like it could be patched so uh yeah there might be
hope but uh yeah avoiding your warranty is always
fun so the paywall is theater and the security also
theater that got me even more interested into
everything and uh people who know me know that I
love reverse engineering and wireless protocols encryption security quirks and funny stuff
so I thought hey this can be fun and when I spent several hundred hours having fun with this
and uh I did some basics like uh decompiling the android
app from the app store with jadx and this is some
really really convenient way to get into stuff um if
people don't know it it decompiles the java classes
and there was one method called is_ speed_ enabled
um in in the part it was referenced by the part
by the billing stuff so maybe the speed feature
is not that uh hardware bound it's more or less a
software feature because you can with this drive
go to eight and a half kilometers um fast if you
pay 99 euros which can make a difference because
when you're going to a bus stop um eight and a half
kilometers per hour is uh for five 400 meters so the bus stop is two minutes and 50 seconds
with six kilometers per hour it's four minutes
and someone is artificially limiting me in this
but the real fun twist about this is going faster
than six kilometers per hour in germany with a
wheelchair is illegal it's it's really illegal
it's not Ordnungswidrigkeit it's it's a Straftat
I did not find any lawsuits about this if someone
was faster than six kilometers per hour and got
fined for anything apparently not so far or I could
not find anything but they are a sort of the speed
feature has some appeal of a crime as a service
feature you can subscribe to crime um okay the
manufacturer knows exactly about this they they
state below yeah watch out for the regular local
regulations and laws yeah apparently they exactly
know so they need to know what to write there and they
can always tell yeah the user was it and where it's
their fault we did not activate it so yeah that's
this uh now more or less how the DRM is enforced in the application
um it's just checking is this thing billed and if yes okay I can access these features
the payment only unlocks
the graphical user interfaces in the app it does not change a thing on the drive itself
it just unlocks certain parts of the application which are not visible without paying for it
so we have some really really uh good in yeah good
indicators that this is maybe software and not the
hardware and maybe someone is limiting this artificially
and trying to make cash and they know about this
uh they posted in uh if someone has very much time and
wants to read um funny um responses from manufacturers
on app stores um I recommend the play store german and
us you can find uh really cringy um responses from the
manufacturer there and I just need to find the responses it's the wrong one this is
I have two of them just close this I think this is
the response from the manufacturer to some comment
or rating in the app store um I will read it in german but I will translate
“The app can only one device at a time, most customers only use one e-Motion system
uh sorry that o change to a new e-Motion system
uh yeah you need to re-pair when you um have a new
e-Motion system like a second one or maybe replaced one
and there's another picture there um which I need to
find too but it's right here (need some Fahrstuhlmusik) *audience whistling* thanks
it worked you can just scroll through the um ratings
um maybe it's even more fun too much desktops
so this is play store and I will just show you that the um another evidence that we um
yes it's really good stars 2 .08 is quite a good app this answer from the manufacturer here
“die Käufe sind an deinen Play Store-A ccount gebunden,
du musst lediglich die App neu installieren danach
kannst du dich mit den getauschten Rädern verbinden und alle gekauften Funktionen weiterhin
verwenden”, so in english “ the things you buy are bound to your play store account you have
reinstall the application then can you reconnect with the swapped
uh swapped uh the swapped wheels and the uh bought
features can be used uh then” so it's uh the manufacturer
itself is telling um this is all software and it's
all play store it's not about the hardware itself
so uh this is some evidence for this and yeah then I
got even more annoyed by this manufacturer and their
business uh practice and when I got really into
the protocol because we have bluetooth at our
um drive and it's used for the remotes they communicate
via bluetooth the app is communicating via bluetooth
and we all know connecting stuff to bluetooth never
ends in “we have no problems” and so they built their
own protocol um to send stuff to the drive and also back from the drive and
in theory it's a really not complicated thing we had some funny design choices and but it's
some basic stuff it's not complicated it apparently also works um
and yeah we have got they got an increment encounter per message message direction to which
wheel from which wheel services in view we in the drive like a battery service
parameter ids like status of the batteries and configuration values and telemetry data
it's got about 14 services in total the protocol from
battery management drive profiles statistics etc.
and every service has parameter ids we said you want
to read battery level it's service two parameter one
change assist level it's a different service different parameter so it's really just
many flags to check to get to the communication
you want to talk with it's well organized and the
reverse engineering was mostly really grunt work and
I had really really much testing involved in this
and what it basically consisted of was I have the
AES key I know which AES they are talking to the
drive and from the drive I can capture it with
wireshark if using bluetooth if using the maintenance
application I used USB they also use their AES
password but it's um I won't tell it here but it's
um the manufacturer and the model name but it's
truncated by I think one or two signs because it
wouldn't fit into AES 128 so they like that they
like chopping off things for passwords or keys and
yeah that was then really really much work at night or
when I was bored is I have megabytes of packet dumps I
I will write a decryptor for this and decrypt the
traffic what it means I will test it with other
parameters with one wheel with a second wheel and so
on so the protocol itself isn't really complicated
but what we protocol enabled me to do is I know this remote has five functions
it's power on and standby it's this is level one I described earlier and this is level two
the outdoor mode and there's a learning mode I never
used but they market is is getting good to know
for getting to know the drive how it works without
crashing into things and it's got a rollback delay
toggle which is kind of a hill holder when you
are on a slope and you stop you won't roll back
automatically and that's all and this thing is 500
euros and I thought yeah maybe we can do it cheaper
I don't know I know the protocol and yeah so um I wrote some scripts in python and it worked
surprise and yeah so this 100 euro per toggle button without the taxes
um yeah I can replace it with some commands okay that's good and but what about this one
this is 980 euro um for self -driving and I paid for myself
and I 'm not using it very much but it works and the
hardware of this remote um I will share pictures
of internals afterwards um are nearly identical
it's a texas instruments bluetooth module it's some
uh tiny electronics like resistors or condensators
condensers it's um here's some LED um stuff blinking
the other the remote has a LCD display this one can't be charged this can be charged by a
um USB -C and this one can when I turn the wheel oh
it's apparently oh it's on safety first but I can
turn the wheel you just saw it and it goes like this
hands -free which is okay and there's also an app
feature for this for 99 euro but I really do not
recommend it because you have to type on your phone
while you are steering your wheelchair I think
this is not a good idea and they are selling it and
yeah but this also showed me that my pricier variant that I have is just the same
hardware as the non -pricier variant the pricier
variant is a boolean flag in the uh manufacturer's
config software and this remote and they are marketing it as two different products
and so it's yeah we are already see or always see
here some artificial scarcity and yeah the speed
increase um was the main feature I was interested in
and what I found out was um also the android app only
checks um if if this feature is bought but there's
also another fun thing there's a 30 -day trial for
this uh for this mode uh where you can where you can
go to eight and a half kilometers per hour or you
can be illegal apparently and uh yeah you can unlock
the ability to break the law by buying something but
it's really convenient and I never use it because
I'm very legal um I would not use this feature
but um the app has a 30 -day um demo version for
everything so you can test all price feature features
in the app and the fun thing is on the drive side
it is even registered that the this test month has
started but it's going on indefinitely that's the
design of it's unlocked you have just uh start the
test app and then you uh the test trial and then
you will have basically the ability to put your
drive faster through this so yeah but by doing all
the protocol stuff I did I have replaced the remote
which is several hundred lines of Python code um
speaking with my wheelchair drive um I could replace
the parking function I could replace some maintenance
features I replace the dealer mode and this
self -driving mode can be done all together so it's
maybe 2000 euro in um in savings just for using
some Python scripts I mean the hourly rate for my
reverse engineering was really bad but it was fun so yeah
um I don't know if we have time for some demonstration I can look up if we can do some from
today I will show a feature from the parking mode I
need this notebook here tower defect good word
I need to first activate the vegan maybe the other
remote is still connected so it won't work
but I've got a video I can show it does not want to
let's turn you off things with bluetooth always not work
bluetooth gods don't upset the bluetooth gods
um I already joked this morning that I can now
go for Tschunk with a remote- operated wheelchair
uh and maybe we will have self -driving wheelchairs
because before self -driving cars I don't know
um yeah this is this looks like now the product presentation now
uh so yeah that's just one example I've got also the
others are a bit boring because it's only setting
configuration flags and reading out stuff so this is the most placative I think
and yeah the time is nearly up but uh one more thing so I wrote some scripts I had fun
now what I would I would like to release this thing or the things the code and I will
on GitHub and yeah people can use it and can use their
wheelchair how they want to use their wheelchair and
yeah I will upload it with the whole tool chain
from getting from to the key from the QR code how to
encrypt/ decrypt packets how to analyze all packets
the packet structure documentation on that setting it
up and yeah I think it's really important to
understand your devices you are depending on and it's
some yeah it's important that manufacturer don't do anything they want because nobody talks
about this and nobody pokes into medical devices maybe that much as into other devices
so if you have other devices you know which have Bluetooth interfaces or other interfaces
it's fun to go at them and yeah talk to me there are also some other findings I found
in the process that I don't want to disclose today
I just to tell this much there's more than this
but we will this will need a proper disclosure and I haven't contacted the manufacturer yet
so that's something for next year I think and yeah I will provide
the link I don't know I think it's not online yet
um but it will be github.com/roll2own and I will
upload the repo I don't know in five minutes maybe
Herald: thanks a lot elfy now it's time for questions quick notice for the watches of the stream you
can ask questions on hackint .org in the # 39 c3 -
hall- zero please walk to the microphones to ask
questions in the room I guess the first question will be from the chat
Signal: yes the internet that this is
sorry the internet is asking can you open the
lockdown UI in adb to access the stuff manually
elfy: uh to access the features
Signal: yep
elfy: yeah you can um you can decompile the application uh edit some
returns from function and it's it's working too
yes but I haven't done this because this is illegal
maybe in addition to the app anyone with the unlocked app can unlock any uh wheelchair
uh from the same model to tune to the higher speeds so if someone sees me uh with this drive
I can unlock you
Herald: next question microphone number two
Audience: hello you told us that the encryption is
well made in a sense it's AES-CBC I think you told
us but the first question when I hear AES-CBC is
is there authentication and is there an HMAC or anything because otherwise there is like bit
flipping attacks and other fun things you could do
elfy: no it's they're just using the standard stuff
they apply PKCS# 7 padding and visit so at several points I had the feeling they know basics
but then they stopped to think about problems so
they do okay with encryption if it's good or not
I think it's better than nothing in this way but it's so frustrating that they
or I think they tried but did not do it to the end
Audience: okay but have you tried to explore this as a
vulnerability because if you could manipulate a
package because there's no authentication that
could be a really horrible attack depending on what the protocol actually triggers the real
shit to do I guess
elfy: um I don't want to tell too much um but there's a counter in the um encrypted
packets which increases every packet sent and the device
does not care if the packet is sent multiple times
it's even simpler as this so you just need a bluetooth packet and you can
throw it at the device for 100 times and you don't have to re -encrypt it or yeah
Herald: okay any further questions
questions there is one question on microphone
five I guess or is it five you are yeah it's you
Audience: um you
said there's a statistics service uh on on the device
uh have you checked what kind of statistics uh are there
elfy: boring stuff kilometers um it depends on the um
system you are talking to on the device you can have
battery statistics how many charging cycles stuff
like this battery health um how many uh power
went through the battery in the whole process um stuff
like how far did this thing travel was the uptime
um yeah so it's really just basic statistics but
it depends on which um service you are talking to
so I would recommend when I upload the code you can
just take a look at the m25 protocol data this is
the specification file in python and it documents
nearly everything what these devices are communicating
Audience: all right thanks
elfy: yes I also tried setting uh higher than eight and a half
but the device will return an error and uh yeah it
apparently doesn't work but um the firmware updates
don't seem to be signed or anything so if anyone
wants to build a free and open source version of it
maybe there's a chance
Herald: okay question microphone number one we would need someone to quickly adjust the
microphone
Audience: yeah I think it's working so I think you're very much for inspiring insight I was wondering
if it's possible to scale it up to 10 kilometers per hours
elfy: I tried it it doesn't work but I tried not
only to configure it and it returned an error and
I did not have time to further test it because the
twion device we had in the presentation this went
this one went to 10 kilometers and is sort of the
predecessor of this device and I suspect as we say
motors so in theory it could I don't know if it's on
firmware level blocked or it's the configuration
would in theory support it when it's configured in a
special way I don't know I tried basic but it didn't work out
Audience: thank you very much
elfy: but it's illegal I heard
Herald: okay any last question microphone number three
Audience: yes um thank you very much for your talk and your time
you took here to investigate this uh aren't you
afraid that you mentioned that you have something
you need to discuss with the manufacturer aren't
you afraid that the response they will give you
be the same they gave to the FDA
elfy: yeah maybe but when I asked and when I can disclose stuff so
Audience: great yes that's good to hear thank you
Herald: okay I guess that was the last question thank you
so much for presenting also thanks a lot for the
interpretation into german sign language a last
warm round of applause for elfy thank you so much