📝 Memo
DEFCON 30 Car Hacking Village Review
DEFCON 30 Car Hacking Village Review
Overview
On the 12th, I participated in the Car Hacking Village CTF at the DEFCON hacking conference in Las Vegas as a member of Autocrypt, which consisted of a total of 7 people. We secured a commendable 5th place finish in the competition. Special thanks to @uberwoozle for organizing this event.
The competition featured several automotive-related hacking challenges, including car simulators, analysing vehicle firmware, obtaining ECU information, and Bluetooth hacking.
Content
In this competition, participants faced automotive hacking challenges such as vehicle environment simulation, ECU firmware analysis, and Bluetooth hacking. The Capture The Flag (CTF) event was held in a hybrid format, allowing participants to solve challenges either remotely or on-site.
This year's most popular topic was the "CloudCar," a vehicle simulator. Participants were provided with server access through SSH and could score points by analyzing specific vehicle behaviors or ECU functionalities. Additionally, fueling the simulated car with gasoline allowed participants to complete laps, earning them 1 to 2 points.
To successfully drive the vehicle, gasoline wasn't the only requirement—windshield washer fluid was also necessary due to simulated windshield contamination effects. Washer fluid was represented by physical cards with unique serial numbers that had to be entered into the simulator. These cards were only available on-site from the CTF organizers.
Participants could acquire these cards by exchanging items—for example, offering coffee or through various other creative methods. This allowed teams to obtain fuel and washer fluid cards, enabling their vehicles to successfully complete laps. Additionally, injecting specific CAN messages into the vehicle simulation allowed some participants to force the car into motion without using the physical cards.
Although CloudCar was an excellent simulator for vehicle hacking, offering many realistic features, it wasn’t very well-suited for the actual CTF event operations. The server struggled with stability issues as numerous participants accessed it simultaneously, and the rules for awarding points after completing laps were frequently changed. These factors were a bit disappointing.
Despite these challenges and the various situations that occurred during the competition, we ultimately achieved 5th place overall and gained valuable experience from participating.
