Ahead of his Black Hat Europe Briefing, researcher Stanislas Lejay shares a preview of what he learned while hacking his car's speed governor, installed in accordance with Japanese law
There's always a smorgasbord of interesting and informative Briefings at Black Hat Europe, and this year's event is shaping up to be no exception.
When this premier cybersecurity conference returns to London in December, it will feature a promising Briefing from researcher Stanislas Lejay all about Unleashing the Power of My 20+ Years Old Car. It's a fun and fascinating look at how Lejay figured out how to bypass the speed governor (set at ~180 km/h) installed on his '90s sports car.
Here, Lejay opens up a bit about the process, what he learned, and what Black Hat attendees can look forward to when you attend his Briefing.
Alex: Tell us a bit about how you got into cybersecurity, and what you're currently working on.
So, I went to a computer engineering school in France (EPITA) and followed the normal 5-year course. However, in the middle of my second year, a senior showed me a book called "Hacking: The Art of Exploitation" that I started reading "just for fun". But as I was reading, I found fascinating to try to think the other way around to break code, and make it do stuff it was never designed to do.
So I started learning reverse-engineering and exploitation in my free time (we didn't have any class related to that until maybe the fourth year, if you choose the infosec specialization), participating in a few CTFs, ROPing in my own code, and just trying to see how far I could go. I played with console hacking, emulation, firmwares, and eventually started working on cars.
A few years, projects and conferences later, I work as a computer security engineer for automotive near Tokyo, and fiddle with my own cars' ECUs on my spare time.
Alex: So what inspired you to pitch this talk for Black Hat Europe?
This talk is just a result of a real-life project I had going on, with a real purpose. And I think that talking about a project with successes and failures, and a clear goal in sight, is the best way to actually get people interested in stuff they wouldn't bother learning about otherwise. People seemed to enjoy my last talk about "car hacking", so while writing an article about it is nice, being able to show it to an audience and exchange thoughts on the subject afterward sounds even better.
Alex: Any fun anecdotes about fiddling with your cars in Japan?
Well, so far it can still pass "Shaken" (the mandatory car inspection every two years) because my system doesn't modify the ECU and is basically just a bypass circuit that I can activate or not with a switch. So, in regard to the law, my car is still 100 percent stock but for "a few additionnal wires and microcontrollers", ha. All my cars are still road-legal so far, as it is one of my main concerns when modifying them. So no, sorry, no fun anecdote on that side!
Alex: No worries! What do you hope Black Hat attendees will get out of seeing your talk?
While this talk doesn't expose anything new, even less knowing that the car is 20 years old, it should still let people get an idea of how fun it is to play with cars, what you can do with them, and that most aftermarket tools you can buy for pretty high prices are not witchcraft.
Communicating with your car and building your own tools for it is actually not that hard and can help you get a lot of insights on what's going on in your car when you actually drive it, for cheap.
Get more information on Lejay's Briefing lots of other cutting-edge content in the Briefings schedule for Black Hat Europe, which returns to The Excel in London December 2-5, 2019.
For more information on what's happening at the event and how to register, check out the Black Hat website.