Inbar (@inbarraz) has been teaching and lecturing about Internet Security and Reverse Engineering for nearly as long as he has been doing that himself, since the age of 9 on his Dragon 64. He spent most of his career in the Internet and Data Security field, and the only reason he’s not in jail right now is because he chose the right side of the law at an early age. Inbar specializes in outside-the-box approach to analyzing security and finding vulnerabilities, using his extensive experience of over 25 years at the IDF, Check Point, PerimeterX, and nowadays Argus Cyber Security, protecting the automotive domain from hackers.

Under Pressure: Real world damage with TPMS spoofing

Modern vehicles are equipped with Tire Pressure Monitoring System (TPMS) – a system that alerts the driver when the tire pressure is inappropriate. TPMS broadcasts an unencrypted data stream at known frequencies and has already attracted the attention of security researchers, who demonstrated the ability to spoof the transmission and cause an alert.

However, while previous research concluded that the worst case scenario would be forcing the driver to pull over for inspecting the vehicle – and by that facilitating some other illicit activities such as robbing or kidnapping – we will demonstrate a specific scenario which, using already-published research, could cause driver distraction, theoretically resulting in an unsafe driving scenario.

In this talk we will quickly go over the TPMS, show how to research it using Software Defined Radio and reach spoofing capabilities, and end by showing a proof of concept for our attack scenario.

This talk is co-presented with Raziel Einhornn, Technical Product Manager at Argus Cyber Security