Attacking Wireless Interfaces

### Automotive Wireless Attack Surfaces At 00:00 and 01:31, Justin Montalbano and Dave Connett of Delphi Automotive introduce the expanding wireless attack perimeter of modern passenger vehicles. Connected cars integrate dozens of RF communication protocols, including cellular telematics, Bluetooth hands-free systems, in-cabin Wi-Fi hotspots, Tire Pressure Monitoring Systems (TPMS), and sub-GHz Remote Keyless Entry (RKE), each presenting distinct avenues for wireless compromise.

### Low-Cost SDR Tooling and Spectrum Reconnaissance At 07:46 and 10:46, the presenters demonstrate how accessible Software Defined Radio (SDR) hardware has transformed automotive RF auditing. Equipment that previously required million-dollar RF laboratory instruments can now be analyzed using affordable tools like the HackRF, RTL-SDR, and open-source software like GQRX and GNU Radio. Researchers can effortlessly capture over-the-air signals, analyze spectrum occupancy, and characterize modulation schemes across 315 MHz and 433 MHz bands.

### Reverse Engineering TPMS and Key Fob Telemetry At 13:48 and 16:49, Dave Connett walks through the "secret sauce" of extracting raw binary data from RF transmissions. Following methodologies popularized by Michael Ossmann, he demonstrates how to calculate symbol rates, isolate Amplitude Shift Keying (ASK) and Frequency Shift Keying (FSK) modulations, and apply digital threshold slicing. By reversing Manchester encoding in Python, they extract unencrypted sensor IDs, pressure readings, and battery telemetry from rolling TPMS sensors.

### RF Chamber Testing and Anechoic Containment At 23:33 and 26:33, the team details professional RF test setups required to safely assess automotive RF without violating federal transmission regulations. They showcase specialized Faraday isolation tents and multi-pane RF anechoic chambers deployed in industrial automotive labs, emphasizing that wireless pen testing on production telematics or keyless entry must occur within shielded enclosures to contain stray transmissions.

### Defense-in-Depth and Wireless Gateway Hardening Concluding between 31:04 and 34:14, the speakers review essential automotive wireless security controls. They explain how implementing cryptographic rolling codes (such as Keeloq variants) mitigates naive replay attacks on keyless entry systems and emphasize that RF transceivers should terminate in isolated gateway ECUs rather than maintaining direct, unfiltered bus connectivity to safety-critical powertrain controllers.

(AI summary — Gemini 3.8 Flash)