I'm Rusty Komori, and this is Beyond the Lines on Think Tech, Hawaii. I was the head coach of the Punahou Boys Varsity Tennis Team for 22 years, and we were fortunate to win 22 consecutive state championships. This show is based on my books Beyond the Lines and Beyond the Game, and it's about leadership, character, and creating a superior culture of excellence. My special guest today is a two-time NCAA national champion on our Hawaii men's volleyball team. He is Jakob Tele, and today we are going Beyond Volleyball. Hey, Jakob, welcome to Beyond the Lines. How's it going, Rusty? Thank you for having me. Jakob, it's so great to have you on the show today, but before we get into some of these details, can you tell me a bit about your background? Of course, yeah. So as you guys know, my name is Jakob. Also called me Jake. Jacob, I have a lot of different names, but I'm from Norway originally. I'm 22 years old, turning 23 in a week. So I'm at 50, playing for UH Manoa for the men's volleyball team. And yeah, I study environmental planning and policy. It's my final semester next year, so I'm very excited to finish that and also finish my last season as a player. So it's very exciting. Thank you, Micheal. Jakob, what brought you to Hawaii? Well, I think first and foremost, it was very foreign to me about going to college, and I wanted to test it out. I spoke to a former player at the University of Wyoming, his fallen ball, Henrik Moll, whose brother is playing beach volleyball, just won the Olympics in Tokyo. And he was actually my high school coach my final year. So I just, I actually just really just easy conversation, he just talked to me about like the experience in Hawaii and he just talked to me like all about it, how you love the culture and just wish you have more years there and then he got me in touch with Coach Charlie and from there everything is just history. So I'd say culture is like the main thing, like I'm a god into Hawaii and just want to like experience some of that, like being all the way from Norway, which is like the almost like entirely opposite. Yeah, it's definitely a long, a far ways away. And Jakob, what is it about volleyball that you love so much? Yeah, I think for volleyball, because I've tried like almost every sport you can possibly do, like I did track and field, I did dancing, great dancing at ballet when I was like very young, I did handball, which is huge in Europe, played a lot of soccer of course as well. But volleyball was like the last sport that I tried out. And I think just one part of that kind of got me like really, really encouraged and engaged in volleyball was just like the fact that like you have a whole team and just like how you work together as a team to get better and just the whole thing about like how you're a part of something bigger than yourself. So that's like what got me most into volleyball and just like that was also the sport that ended up playing and still play. So I mean, it just felt love with it because of the team aspect of the sport. Well, Jakob, you guys won the national championship in 2021 and again, this past year in 2022. Tell me about some specific experiences when you guys won it in 2021 and then again in 2022? Yeah, for sure. Those, both of those years were great. I think they're all like had their own story to it. The first year we had a lot of really like leader seniors by Colton Cowell, Rado Parapuna, Patrick Gassman, Jackson Fenneker and then also Gage Worsley. The second year all those guys were gone and like all those guys were also Americans. So it was a huge change as a team to kind of find ourselves and find our role in the team. I was one of the guys that had to step up, take more of a leadership role because I already played that past season. I was like one of three starters for Chas and G to be on that team playing the 2021 championship game. So I think just that year was just this past year in 2022 was just a whole like new like learning curve for me personally, but also like as a team because we have to find collective ways to still win because we knew that we had to target our backs to be defending champions and was so good at it. So we definitely achieved that success. Now, Jakob, how does it look for this year? I mean, you guys have a great chance to do a three-peat. Tell me about it. Yeah, for sure. I mean, not that we already gone twice back to back then it's always about like making that third run because I think like it hasn't happened since the eighties back with UCLA did it. And actually in the region was a part of that team too. I'll see. But yeah, I think nowadays we have to create our own like history for this year because we always think about like taking one year of the time, taking day by day and like just not like thinking about like what if or what if we went or then we're like looking back and then okay, maybe we didn't do it but then we just hope that we always can do the right things every day and a daily basis to always like have that goal and the whole team has that goal in mind. So that's definitely something that we like want to do and we know what it takes but also we have to stay in that as it's the whole challenge of it but also the beauty. Now, would you agree that the Stan Sheriff's Center is the best arena for college volleyball in the country and how big of an impact do the fans make with you guys when you're competing? They make the whole difference to be honest. Like I can really be like frank about this but I think like the fans is like what the huge part of like our success as a team, as a program and for the school that just all the energy that they have the love and aloha that they give us is really what takes us to the next level and just playing in the Stan Sheriff's Center when it's packed or just even like every like any kind of game I just remember my first day coming into the arena and I was just like shocked, just looking up and all the empty seats and then seeing it full I was just like the whole just wow, like I can't believe volleyball is like such a big sport and it brings so many people together from the whole community just that's like the most wonderful thing. And I think to just like not even like on the national basis I think that the Stan Sheriff like has the best environment for volleyball the whole world like no matter your level high school professional or college too like I think nothing can match the Stan Sheriff's Center when it's rocking. Oh, I completely agree. I mean, it's so fun to be in there. And Yacob, do you still get nervous when you're competing in some of these big games? Ooh, I think I'm more nervous before the game than when I play because when I play I got my game face on. If he walks me play, I'm very like it looks like like I can do something really bad but I'm very like up go A and like I laugh a lot I smile a lot as you probably can tell but when I play the game like my game face is on and like I will do whatever it takes to win and that also just goes on like being the best role model for my teammates and everyone watching. But yeah, I still get nervous like occasionally but I think I'm more nervous as a coach and as a player. I, you know, I would when I was coaching I would tell my players that, you know if they weren't nervous, then I'd be nervous because actually being nervous shows that you care about what you're doing.  And I want to ask you about coach Charlie Wade. What is, what are some things and some reasons why he is such a great coach? Yeah, for sure. Charlie is like one of the best coaches that I've had in my life and also like the way he values culture and that's like the whole thing about like before I came to the U.S. I thought culture was something like very like glorified like American I can just call it. But then I like, of course, Charlie and he like brings me like to what culture means for him and then how everyone on the team can kind of buy into that as well. And then he also, of course, like the unique value of like being in Hawaii like you're representing a unique culture and how you can also have that influence on the team. So one thing that he brought up is the Aulacahi Matrix that we really stand for which goes on like all the different values within the team with either if it's the Kuliana responsibility you have for yourself and your teammates everyone around you just being a part of something bigger in the community and really representing that the best way possible. Lukahi, Ikaika, we also have just the emphasis of being doing well in the classroom, doing well in the way room and also thoroughly involved the court, of course. And the practice gym. So really just brings up all those values and together in that matrix. And that is the reason why we have that on our backs on our practice shirts. It's not because of one of the guys in the team to name is Aulacahi, but also because we're representing the Aulacahi Matrix which is like the definition of leadership and culture and the Hawaiian local knowledge and yeah, culture. Oh, and I love hearing about the Aulacahi and what it all stands for. And Yaakov, what do you guys do off court to try to really enhance your team bonding? On the court? Off court. Off the court. Okay, good. Off the court we just ran out, we're very social. Everyone is very good friends with each other. We have a great team dynamics as far as that. We have a couple of social settings where we go camping. We did that one time in the fall before 20 hours started like the hard court practice period. And then just like, we're always hanging out together, go to the beach together, just like doing all these like laid back. Like, because you're living in Hawaii, you got to like really just like embrace that and go to the beach as much as you can. But just like do things together, having good vibe, good connection. We're communicating real well to each other. So that's like some of the things that kind of define us as a team and just always being humble to each other. And that's like number one, just caring about each other more than yourself in a sense too. Because I just serve part of the team. Like you always want to care about your teammates to the extent that you care about yourself. So it can't be about me, it's about we. That's like the biggest thing. No, I absolutely agree with you there. And earlier when you were talking about the culture of excellence on your team, you guys are so disciplined. And I mean, that leads, I always say that you need self-discipline because that leads to habits, which lead to success. And you guys have achieved major success. Now, what are your practices like? Yeah, so they're very, very intense to start with. We're always doing a lot of like serving, hitting, everything is involving jumps.  But also we have a good balance. We're a lot of business of a lot of his Serbian, Serbian workouts and drills that we do always every day. So we always have that same consistency like in the practice gym, we play a lot too because they're ready to get better like in the games about playing more and then you play better. So that's like the whole kind of hierarchy that we have in the practice gym. And we spent a lot of time just being mindful about what we're doing, taking breaks in there to kind of just like talk about like some basic things and things that we have to get better all under in the practice gym, but also like when we play games. So I'd say like, we always have a pretty good base of like getting into like the higher intense and then the end we kind of drop it down and then just end up stretching, which is also a good part of practice, but they're very, they're really touched upon like the stuff that we have to work on a lot. So that's like the biggest thing for us in the practice gym. And fundamentals.   What's your mindset like? What are you thinking about? Just doing what I know I can do. It's a routine that I've been working on for years and I feel like now like that I have the same routine. I just try to make my same, the same habit, like taking my time, looking at the ball, looking at who's the receivers across the net, getting the best toss in so I can fly into the court and hit it, hit a high thumb up and just go for it when I have the green light. That's like the main thing and just being confident because serving is like such a like mental game. Like that's the only part of the game where you're in charge of what you're doing. So you have to really just take your time and just really embrace that. You can make a huge impact by like having good service. So for me, I'm just like, okay, great. I'll give my chance. I'll show you how to send. Yeah, you're the hammer out there, Jacob. Oh, I tried to be. We got choked cameras on the team though. Well, that's that's always a great thing for our Hawaii team.  And I wanted them to be relentless competitors from the first point to match point. And I always would share that we're always in one of three situations when we're in competition. We're either winning, losing or tied. But our effort and attitude should always be at a superior level. What are your thoughts? I definitely agree about that more on the ethics that you have there. I think a lot of it too, it's just like being in practice gym, we're always very aware of like the setting we're in and like trying to make all the situations as we're in the game. So like if we're playing Long Beach or we're playing Long Island, like it doesn't matter, like we have to come in the same way, execute the same level because if we're not then we're always, we're going to have a tough time. Like the last season we lost five games which is I'd say a lot to win. So when the national championship it was like just like kind of figured out like that consistency and having that same consistency every day, like all the habits, like everything you're like all the choice you're making every single day is kind of accumulating into a bigger thing. And that is to win and be successful. So then if I want to do that and their flex on your choices and decisions and everyday life, then I think kind of good path. I like hearing these insights from you.  And that's what you guys do. And Yacob, you have both of my books and I want to know what's something that stood out to you in it. Yeah, so I was fortunate to read your books. I actually got one of them right here. I think it's your first book, if I'm not wrong. And I think just like you just like said like that simple, those like three words you had in the sentence where it says little things matter like that's everything. Cause I really think like building a culture I think that's the chapter that I was reading about building a culture and becoming successful. It's about the little things. So like all the decisions that you make every day and just ensuring that that is like on par with the dreams that you have for tomorrow. That's like the saying like, so when you have a goal as a team and individual goals as well you want to always make sure that your decisions and your habits are really on par with that goal and dream. Cause I think if you don't, if you lack consistency and you also like motivation it's going to be tough to achieve that goal. So you're always going to be kind of driven have like your inner coach like which is another aspect of the book that I really liked just having you're having your fiscal coach but also you have to know like your inner coach and inner drive cause you're the one you're responsible for development and the way you contribute. So then you just have to embrace that part of it. So that's, yeah, again, good read of the book. So I just really enjoyed it and it taught me a lot but also I can see a lot of the themes that Coach Trello has been saying and to practice them into us guys and also like things that I've also been reflecting on myself as a player and individual. No, I love hearing all of that Jakob and you are the captain on court. I mean, you're the leader on the court with your team. What do you focus on as the leader on court in these games? Yeah, so what I try to do the most like I think I'm a very different character like from practice to the real games cause in the practice I can, I can fool around like have a lot of fun but as I'll try to do that in the games but I'm also more serious just like personal character you got the picture right there I'm pointing at someone I think is gay she just made an incredible dig as usual but I think I'm just like trying to bring more confidence to the guys because I'm the center I'm dishing up everyone to look good and be successful in the race like throughout the game so we can be good as a team but I think just like I want to be confident I want to be like someone who can look and be like, okay, he's like really into it and like he wants to win the game and then people can just like, yeah just learn from that and just also be in the same kind of game mode I feel like so we always try to be like confident, humble and very encouraged in the game so it's like some of the three big things that we're kind of doing and what I want to also get out as a leader and a center because that is not true like a leader position. Now, Yaakov teams can have great players but that doesn't necessarily guarantee victories these great players they got to play together they got to work together they got to execute together they really got to play as one unit what are your thoughts about that because if they don't that's where the word upsets come in, right? Definitely, I don't think you can also do that like in pro because that's when you can like really just like privatize and capitalize on like the best players all around the world and you see in Italy like that is the best league in the world right now and you have a team of like all the best players and like each national team but still they're not winning because as a team they're not just not good enough in the end against teams that are maybe weaker and like they have less of a budget but they're just more cohesive and I think that is the key word is cohesiveness because you just want to really build a connection between the guys and like perform well as a team because when you think about individual stats like they really don't matter at all it's about the team stats and if your team wins then it's successful that's what goes into it so definitely you're just saying like you need to have one thing is having good players but just having the right attitudes is like another thing that you have to do to be successful in the game. Now, as a coach for me I would always try to identify my players strengths and then I would want to make my players strength stronger because that's why they made the team is because of their strengths not really focusing so much on the weaknesses yeah we want to improve a weakness every so often but it was more about really making the strength stronger what are your thoughts about that? I agree if you can't make one of your strengths to your player advantage then you're not going to be the factor that contributes to the win or whatever that is in the sport or in life so I think it's really important to find your strengths and kind of articulate them with the coach or as a team and kind of build off of that like on our team now we have a lot of guys who are maybe you can call them undersized but the facilities jump incredibly high and they're also so quick so like we're trying to use more tempo like we're trying to build up those strengths so for me like I guess I'm the quarterback in like the American like sports setting so like I'm building the offense and then I want to make sure that I can use all the strengths and kind of build off of that so we can use that to our advantage I love it and Yaakov what's a big adversity or a big challenge that you dealt with in your life so far? I think it's got to be the one it's got to be COVID-19 I think that stands the same for 99% of the whole world right now it's definitely COVID because it just changed the way we think about everything really like in everyday life and how much that of an impact and just forced you to think differently about things and also just like forcing you to think about the stuff that you can control so for me personally I have to build new habits in COVID I learned to do a lot of things that I already didn't know so I learned to cook that's one big thing I learned how to cook and I just learned how to get better in the classroom build habits routines that would kind of sustain me for the rest of the years until graduation which I just completed my undergrad last semester and now I'm doing my master's in another year so just like building habits are gonna be effective you can still be productive even though like you're in a lockdown then you can still maximize the thing that you can do like virtually and also so I'll get some time to be outside and even though I couldn't go to the beach because I went to Norway but I still got to enjoy the time out in the snow and cold so that was so good but yeah just definitely COVID that kind of changed the way I thought about life and also about volleyball so Okay so Jakob, what's some of your favorite dishes you like to cook? Whoo, I'm trying to learn how to make poi which is a big one. Oh really? Yeah, my first year I was not a big fan but then over the years I got more poi and also having that with poki I think that kind of changed everything that's a game changer but also yeah poki because I love fish I love gochupo gochuling with a pulb and a squad so I think poki and poi is like the favorite but like I'm still trying to figure out those two that like I want to open a restaurant eventually and then it depends if I come back to Hawaii like I want to open like something more like Sydney and like the coffee shop and then I sell like if I go back to Norway I want to open up like a poki shop or like where the sell spice, yeah because that is my favorite but yeah I keep the same class as you You are definitely local Yes, I am Yeah Ayaka, when you reflect back on your young life so far what's a valuable lesson you've learned? I think that definitely will be just taking things day to time like not thinking too far in the future or too far in the past but just keeping it day by day and being mindful I think that is like one thing too it's just like mindfulness and how will you go about the things that you're doing right now like staying in the moment I think is the biggest lesson that I've had over the course of my life and just yeah, taking it day by day minute by minute Yeah, I like it because that's present focus, right we can't really worry too much about the past and not really get too tied up into the future but really focusing on the present and what's the best advice you ever received from somebody? Well, I watched Topka and Maverick like a couple of weeks ago and they already said, don't think just do and I think that goes for the same little life as well I just, well, I've heard that before I heard it from the movie of course but I think just like that part like just doing it, like don't think about it don't overthink it because as soon as you're overthinking you will change the way that you were originally trying to do it just be comfortable, be confident and just go for it like stay in the moment and just do what you're normally doing like don't change anything up keep it simple and keep it confident Well, what a great movie that Topka and Maverick Yeah, I go on, yeah, I enjoyed it not as well as the original but it was so good to follow up even though like it's 30 years later Yeah, good movie, inspirational I completely agree with you and Jakob, you're somebody that have achieved greatness and greatness can be defined in many ways how would you define greatness? I think I would define greatness by consistency and being consistent about what you do because once you've like developed the good routines every day then you can kind of build off of that and I think if you're consistent with it eventually you will achieve your goals and also either as individual or your team goals that will kind of sustain your greatness and success in life and in sports so I think just consistency being like on top of your things every day and yeah, like doing what you know your best at and also trying to find your weakest links and work on those so like you're ultimately just a better overall version of yourself I think it's the one but I think that is the question though defining greatness I think I think there's a lot of different definitions but that is my personal one And you know from the outside looking in when I'm watching you play with your team I mean you really inspire your teammates I mean it's so obvious to me when you're playing about you know how much better you just kind of help your team rise to the occasion I mean and I always say the greatest leaders always build other great leaders that's what makes them greater but it's the it's to help them inspire and what are your thoughts about that? Yeah, I mean I couldn't agree more first of all thank you for seeing that as part of this that's like one thing I strive for but I think that is like what you have to do because if you want to sustain culture and the team or wherever you at in business or just social aspects you always want to encourage people around you to also be to be leaders and that goes into the lead by example that if your actions are the right points then people will see that and they will like also do that as well which kind of builds that culture progressively and that is like maybe the reason why like the culture like in the UH Meswella program has been so like it's always been there like even though the results have been coming up over the years I think that is a product of the culture that the people and all the way in 2010 and like even in 2002 and three like that people built from there and just put that foundation out there so people can follow and then because when I was a freshman like I was looking up to the seniors like Joe, Brett Rosemeyer, Stein a lot of those like really talented guys and yeah just learning for them as well and not to forget Dalton Slowbreak as well so I think that is that is the thing that you like want to express yourself and you want to have the younger guys kind of look at you and the guy like whoa, okay, I want to do that too, so. Jacob, I want to ask you one more thing before we wrap up obviously communication is a huge part of leadership and for me I would always share with my team that I don't give good feedback or bad feedback I give honest feedback. How do you communicate with your teammates? I mean, are you very blunt where you can say positive and negative things to them? I probably just joke around for a second and then go like into the serious things but no, I'm always like trying to work on things with the guys offensively or just like as a whole like whatever can help the team. So like I think I'm pretty direct I will say like things here and there that would help you like I want to send if that will hurt you or like the way you perform I'm like my intention is always to help the guys around me and make them make them better so I think that is like what I go with like every day in the practice gym my whole goal of the day is just making people around me better making each other better and I think if everyone can have that same mentality then awesome, that's the whole goal.  I mean, one of the if not the best volleyball player in the United States right now but you have such you're more of I mean, I love your character you have exceptional character and I really want to thank you for taking time to be on the show today. Well, thank you Russ for having me. I enjoyed it and it's a good talk and I think that's an important conversation to have like within your team and business and in life just always touching upon like these topics and kind of elaborate on them. It's a good discussion. So I really appreciate it. Thank you, mahalos. Thanks, Jacob. And thank you for watching Beyond the Lines on Think Tech Hawaii. For more information, please visit RustyKamori.com and my books are available on Amazon and Barnes & Noble. I hope that Jacob and I will inspire you to create your own superior culture of excellence and to find your greatness and help others find theirs. Aloha. Thank you so much for watching Think Tech Hawaii. If you like what we do, please like us and click the subscribe button on YouTube and the follow button on Vimeo. You can also follow us on Facebook, Instagram and LinkedIn and donate to us at thinktechhawaii.com. Mahalo.


Welcome. Thank you for spending your time and skipping the last testimony to come see me. It makes me feel great. So I'm here to talk about automotive bootloaders. So I guess, first of all, a little bit about who I am. I'm Phil Lepchinsky, so it's lap with all the consonants and then ski. I'm a software engineer, senior staff engineer at Renaissance. And we make chips and all kinds of things. So what am I here to talk about? Embedded bootloaders in automotive. So what does bootloader do? Essentially, it owns the reset vector in the microcontroller. And on reset, the bootloader is going to determine if your application is valid or not. If it's valid, it allows you to load the application. And on a big system out of chip, it might copy that over into RAM and execute it. For embedded devices, though, it typically will just jump to the start vector of your application. Also, in like deeply embedded devices, the bootloader usually allows you to reprogram the memory, the flash and the micro. So you can see the mouse. So here you have the roulette vector. Jump into the bootloader. It's going to do some stuff to determine if you have a valid application or not, and then jump to the application vector. So we've got these in the car. We know that they're in there. How do we talk to them? Well, we make it easy in automotive. We have a proprietary connector for OBD and you have to get special dongles like the car hacking village dongle. So everybody go buy one of those. They're 80 bucks. But that allows us to connect to the CAN bus. So that's defined by ISO protocol, released in 86. But it's 2008, become mandatory. So we know that any vehicle after 2008, it's in there. We can talk to it. And so that's the physical layer connected through the OBD2 dongle. To start talking to these things, so CAN, only 8-byte payloads. That doesn't give us a lot of information with some small commands, but we can't send large amounts of data. So I know. So we got the transport layer, 15.765. That's the underlying transport layer that sits on top of CAN and between CAN and the diagnostic layer. So this basically allows us to send payloads up to 4K by segmenting the messages. So on top of that, we're just going to make layers and layers and layers of protocols to make it confusing. We've got ISO 14229. That's Unified Diagnostic Services. So this is a ISO spec that basically defines a whole bunch of common services, essentially creating the API. It's a client server. So you send it a request with your client. And the server running on the ECU will send the response. Essentially, this spec defines all of the different standard services. There can be also OEM or supplier-specific services as well. And there's also security levels. So there's different sessions to get elevated privileges. For bootloaders, we're typically talking about the programming session. ISO Define Session 2 has the programming session. So if you send a session control change request to go into the programming session, now you go into the bootloader. So this is where things get interesting. And I guess before I jump to that, let me explain. On an embedded device in automotive, the bootloader is typically a whole separate executable program that's separately compiled from the application. So there's some kind of inter-process communication that happens between your normal application and the bootloader when you're passing the information through. So that's usually done through a reset. So you might get a programming session control request. And it'll set some flags and then cause a reset. And then the bootloader says, oh, hey, I'm in programming session. Let's go do something interesting. So what does this look like, the typical programming sequence? It's broken up into three distinct groups. There's this pre-programming sequence, which happens before your program. There's the programming sequence, which is when you're doing the programming. These are really easily named. And then the post-programming sequence, which I bet you guys can guess, it's after your program. So pre-programming, what happens here? This is usually OEM specific, really what you're doing. But in the ISO spec, there's common things that typically happen. Oftentimes, you'll do a session control and jump into this, the extended session. So that's session three. And the extended diagnostic session gives you elevated services than your normal diagnostic default session that would be like you're driving around in the car. So what you do is you go into this extended session, and you start doing things that are going to prepare the vehicle for programming. So one of the common things is to turn off DTCs. So I'm going to change my application software on the car. And all these other ECUs are still talking to each other, or they're looking for messages. So if I have an ECU that's down not sending its messages, everybody else that relies on my messages is going to say what the hell's going on. It'll start setting DTCs. It doesn't know what's going on. So typically, when the diagnostic tester is going to initiate a programming session, it turns off all the DTCs. It might turn off, disable the non-diagnostic communication, and so say, OK, everybody be quiet on the bus because I want to start reprogramming ECUs. This may or may not require security access to get into this session. Again, this is all OEM-specific, and the OEM specs are all secretly guarded and under NDA.  They don't let me tell the secrets. So then there's the programming step. And this is when you basically activate the bootloader and unlock it. UDS defines a security seed key exchange, so service 27. And you basically, the tester will say, hey, go give me a seed, sends the seed back, and then the tester will send the response. It's a challenge response protocol. But again, the way this is programmed, the actual algorithm is not defined by ISO. That's defined specifically by the OEM. One thing to note, again, the industry is continually trying to strive for better security. But historically, OEMs didn't always do a great job with their security algorithms.  And the secrecy of it is because it's hidden in a desk somewhere. But lots of smart reverse engineers out there that can figure things like that out. So historically, that's been a problem. The industry is working towards better types of security there so other things like better entropy on the seeds. That's another problem. Anyway, so you unlock this thing, service 27. There may be some write data by identifier service where you write like a fingerprint or some specific information. So this is typically like the tester might do like write the programming date into the ECU like the last time it did it or write it's like serial number. So like the tester serial number and say, hey, this was flashed by Ben's serial number. One, two, three, four. Very professional. So then what it'll do is, again, this is, a lot of the stuff is defined by ISO, but exactly how it's done is OEM specific. So some OEMs will have a secondary bootloader that you download and typically what's in that is like the actual flash routines. So residing in the ECU normally, they're not in there. So you can't like just, you know, gain, do like some buffer overflow and get into there and rewrite the ECU because the code for that's not even in there. The flash drivers are actually downloaded by the tester and they're set up specifically for that ECU. So you download that and then you activate that. And so that enables now the programming routines. So the next thing that happens then is we're going to get into this. So once we've activated the bootloader, we're going to get into this download stuff. And the way that looks is you have a request download, so service 34, which says you send basically your address and the length. And there's different types of addressing like some OEMs will have like actual address based addressing. Some have what's called like logical blocks where you get the logical block identifier. Again, it's all of the stuff is proprietary. Then you have the service 36, which is the transfer data. So you're sending this and you can send basically, you know, 4k at a time until you have all of your data there. Once that's happened, you do a transfer data exit. And so this is typically where you do something like a checksum or do an integrity check of all of this data before activating it. So there may be like a routine control after that. It says, hey, do this check routine and check the checksum on it. That's the basic least secure way is just doing the checksum. You know, it varies wildly. It's all OEM specific and proprietary. So a lot of times this could be also where you do like the code signing check verification. But really that could be done in the transfer data exit or it could be done with a special routine. It's all up to an OEM to decide how to do that and their specifications. So, okay, all the data's got there. We sent it to the ECU. We've verified that the data's good. It's good to go. It looks authentic-ish. Now what happens? The tester will say, okay, go back into the diagnostics or the extended session. We start getting it ready for the post-programming. So you turn the DTCs back on because now your application is all working great and you can turn the normal diagnostic communications, non-diagnostic communications on and then you usually do like a session control to the default session. And so this usually happens through like a reset. So the bootloader says, okay, we're done.  So, okay, now that you have like the most basic understanding of how ECU bootloaders, or automotive bootloaders work, how are these used potentially as an attack factor? Well, there's lots of things that it can do. It's a very powerful. It's its own application. And so just by what it does, it's normal operation, it necessity, like by necessity, has to do things like, well, it prevents the application from running because it's its own application. So if you can say, hey, go into the bootloader. The application is not working. And why would you want to turn the application off? Well, what if you're trying to like spoof messages? If you're spoofing messages on the bus and the ECU is also sending out its valid messages, well, now you're, you have this contention or confliction. If you like to make up words. The, so if you have this, you know, now you can turn this ECU off and you can send its messages and spoof the messages. Most automotives right now are not using, like can is not by the protocol itself, is not sending authenticated messages. It's a bus protocol. So if I send messages with this ID, with this signal, I can now, you know, the ECUs that are listening to this can now have to listen to it if it's, if you're on the same bus and all those other things. So turn the ECU off and send your own messages and spoof those. It's also, it is out of reset the decision maker, right? It's deciding, is this application valid or not? And meaning you could also say if you can make it so that it thinks the application is not valid, well, now it's not going to run that application and you're permanently disabled or if you can somehow subvert the validity checks, now you can execute non-signed code or you can execute whatever you want, right? It also, by nature, has ways to input data or ex, or data, you know, exfiltrate data. So some OEMs implement request upload. Part of the ISO spec. It's available. The general practice is not to do that because then you could just send requests to pull all the code out of there, your firmware. But it's, some OEMs do it or the supplier implements it for whatever reason. By the nature of the ruler you can write data to it, request download. That's, you know, if you can write something into RAM then maybe you can execute it like a couple slides back. We've got this programming step where you're downloading a flash driver. So that's basically downloaded and run out of RAM. You can read interesting data, right? There's the service 22. Read data by ID. So if you have IDs we can read certain things out of there. That might be interesting in getting things out of it. Again, it might have, because it's so it's a separate application, it's a different session. There may be different dids available than what are in the application. You can read information sometimes out of the boot loader. You may be able to read a specific spot in memory. There's a service 23. Read memory by address. And again, these are all like, these are just the ISO services that are defined, right? You can look them up online. Write specific parameter data. So write data by ID. That's available. Write memory by address. That's a service. Usually there's range checking and stuff in there if it's done, implemented correctly. But again, there's a lot of powerful things available if you can get around security there. Another attack factor is the programming sequence. So if you have a valid tester even without knowledge of the security or anything like that, you may be able to record the programming sequence. You may be able to replace certain parts of it. You could potentially intercept firmware over the wire because lots of OEMs don't, like, encrypt the data once it gets to the CAN bus. It might be encrypted at rest. It might be encrypted in the cloud when they pull it down. But the the ECU doesn't have, like, the symmetric keys in it to, like, decrypt the firmware. So it's usually just transmitted over, you know, unencrypted. Again, this it's all OEM specific and people are moving towards encrypted firmware, of course. But you know, that could be with a valid tester that could be easier than you know, trying to get JTAG on a device and pulling the firmware, right, if you can just snoop it off the bus. Again, I mentioned this before, replay attacks on certain sequences. So if it's, if the tester's validly doing something interesting, you can record that in CAN and then replay it. And how would you do something like that? Well, I'll get to that in a second. Also, by nature of what the tools have to do, right, the programming tool is going to have the images, right? You have to flash these images to the ECU. So if the tool itself is not well protected, that may be like an easier attack vector than trying to like you know, get a buffer overflow in a boot loader or trying to get JTAG or somehow like taking this, you know, pulling the firmware off the ECU because the programming tool itself needs to have the firmware because it's sending it to the ECU. You can also get information about the proprietary programming sequences and things like that because you know, unless you have specs from an OEM or you know, have access to this stuff, it's all highly secretly guarded, right? Also, anytime, you know, it's using any kind of like symmetric keys, like if it's the CT algorithm is not authenticated all the way to like a back end, the tool itself, you know, may have the symmetric keys for CT. So instead of trying to reverse engineer this firmware or, you know, hack into an HSM on an ECU, the programming tool might just have all the algorithms in it. Another thing that's awesome about UDS is that so that the way the seed key is designed is basically it's like a, you know, it's like a blind butler, like you do the secret knock and he opens the door and then anybody can go in. So once you've, you know, once you've unlocked the ECU or gotten into that session then you can just kind of keep that session alive from a valid tester and then send whatever messages you want. So kind of snooping a valid session, you could hijack that and send kind of other things. So having access to these testers or if you're on the bus at the same time, it's kind of you have lots of access there. Other tag vectors. A boot loader trojan. So, you know, there's ways to even gain persistence on an ECU by downloading a boot loader that overwrites the boot loader, right? There's products that do this for updating boot loaders and essentially you program an application into the, as the new application has to look like a valid application and then it just overwrites your boot loader with its own boot loader.  So, what makes this even more scary? So before, for all of this, you had to have physical access to the vehicle, right? So, it doesn't scale well. I can't physically walk to a thousand or a million different vehicles and start changing the firmware on them. But, don't worry, everyone solved this problem because now everyone wants to add over-the-air programming. So, many OIMs are incorporating this. Implementing is just like a diagnostic tester that's connected to the internet, right? So, depending on how secure that is, that can put in a lot of challenges, right? OT is awesome. It's great for fixing bugs. We can add features. We can do security updates.  OTA, basically, is remote code execution. And generally, that's bad in terms of a security model. So, it's like, it's the savior, but it's also the thing that can really hurt us. It's kind of a two-edge sword. And it opens up some interesting challenges that we might not have had before. So, attacks on, like, repositories itself there's, you know, Defconn's huge, right? There's all kinds of fun talks going on. I'm sure somebody maybe this year or certainly in previous years have talked about, like, repository attacks on updaters, like, for Ubuntu and, you know, Windows Update and all that. Same thing with, with Automotive, right?  Also, there's some challenges in keeping OTA going, because the car has intermittent connectivity. You know, if it's parked in a garage, it doesn't, might not have access for who knows, right? Or somebody might park this car in a garage for 20 years and turn it on and now you have, you know, 6 million software updates. You can't drive your car for three weeks because it's downloading. And then, like, man in the middle type attacks to the vehicle. You know, it's, it's literally a moving network, computer network, so it's, it's a really challenging IT problem to maintain this kind of infrastructure and securing all of that. So there's a lot of new challenges that could prevent updates or pass bad information to the cloud or to the vehicle. And so it kind of, it's pushing, you know, OEMs to have to really think about the full end-to-end lifecycle for updates. Oh yeah, and cars move, so if you brick your phone, usually that's, you know, that's a bummer, but if you brick somebody's car and they're in the middle of, I don't know, the desert, they're not going to be particularly happy. There's also all kinds of, like, OTA attacks. There's a, so there's a project called Uptane that's doing, like, a security model framework for OTA attacks, and they've kind of enumerated a whole bunch of different things, like malicious software attacks, you know, updating, trying to poison the cache with bad updates, freeze attacks where you're stopping the updates, basically stopping the updates from having by slowing it down, or maybe you have, like, bad, vulnerable software trying to get the ECU to roll it back to a bad version. There's a lot of challenges, and lots of ways to, like, DOS the system, so it's quite a big challenge. So, now that it bummed everybody out, or maybe they've excited because maybe they're trying to hack cars. This is the car hacking village, right? So what's the industry trying to do to make it more secure and for people that don't care about that, that also means what might not be implemented right now? Things like code signing, right, where you take a message digest, you're signing it with private key, penning that to the data, and then verifying it on the ECU side. So this is one of the, like, things in that obtained project. This is one of the things that that project is really trying to, like, set up delegations for how you make a signature scheme for automotive really fault tolerant against different types of attacks. So a lot of work being done there. Secure boot, push and secure boot. You know, so this is, like, building a chain of trust to ensure the authenticity and integrity of code at startup. Like a, like, a she module, which is, like, a small HSM. You know, these might have, like, a really simple secure boot, but if you get into, like, the systems on a chip, that there's the main, mainline talk, I think, yesterday about the Qualcomm firmware, and he showed, like, the Qualcomm firmware secure boot chain, and it was, like, 45 different things. So each one of these might have, like, could have a vulnerability, right? Protect that whole thing. So these can get really complicated and really, really tricky. And also who owns the keys for a secure boot chain as it becomes really complicated, because it could be in automotive, we have this big, huge supply chain, and different stakeholders might need to own different parts of it. So, like, an OEM might want to own some things, but the original equipment, like this tier one supplier might also need a stake in it. So it's, like, these things can get really complicated and they're hard to, they're tricky to really secure. But we're working on it. Another big thing, like, this is, you know, what I work on all the time, hardware security modules. So this is, like, hardware acceleration to help facilitate some of these things. So, like, I mentioned before, you know, you've got the seed key. So, one of the big problems with that is, like, really, really poor entropy on your seeds. So somebody might just implement, because we don't have, like, there's no, like, real-time clock, there's no, you know, good timers, you don't have a good source of entropy on these ECUs. So, you know, people would implement this, like, super awesome proprietary random jumber generator, and you know, it throws out four different random numbers in a row. So it's really easy to replay these seeds. So hardware facilitated true random number generation. That really helps with certain things like that. Protected key storage. AES hardware acceleration for symmetric crypto or other symmetric crypto accelerators. Having public key crypto accelerators in there. Again, you know, the idea is to protect all the keys and also try to help accelerate some of these things so that we can do, enable things like real-time authentication and encryption and message authentication and things like that. There's also things to, like, enable secure boot in hardware. One of the challenging things with this, though, is that there's not, like, a one-spec to rule them all in automotive. So a lot of stuff is using, like, TPMs and, like, IoT or PCs and, you know, traditional IT. In automotive, there's this, like, baseline specification from this is, like, the hilarious German pun here. They call it the HISS SHE. So HISS is, like, the Hirsteller initiative software.  It's the SHE spec, which is the secure hardware extension. And it just defined, like, certain things in hardware that would, they specified for security. And it's kind of, like, a stand-alone peripheral. And so a lot of silicon vendors have implemented that and have support for that. But OEMs are, you know, moving even beyond that. A lot of people need more keys or they need, like, more specific stuff, like a secure execution environment. There's another there's another few years later group in Europe called Aveda. It was, like, a government EU-sponsored consortia. And they came up with, like, another spec that kind of divided it up into, like, three different levels. So this low, medium, full Aveda spec.  So again, silicon vendors are, like, implementing stuff like that. Like, we have one called ICWEM for that. But other silicon vendors, like NXP has the CSE, which is the cryptographic services engine. And Phineons got their own stuff. ARM has the trust zone.  So if you're interested in that, there's lots of information on trust zone stuff. So it's, it's, it's kind of a big challenge because there are so many different varieties. And there's no, like, just common, you know, API for, okay, here's the automotive API and spec for building this secure hardware as a chip vendor. So every OEM kind of just has their own, their own flavor of how it works. So again, this is a challenge. But there's also, you know, committees that are working on kind of creating more common specs. There's a CSE group for that. And there's also a ISO group that's working on kind of, like, common security practices. Some more stuff. So ECU hardening. This is just, like, general security, good hygiene stuff. But, you know, you'd be surprised how often this doesn't happen. And most of the OEMs have specs now that say, like, yeah, you have to lock the JTAG. Or, you know, tamper protection, things like, if the tamper protection is detected, it erases your keys out of the HSM. So even if somebody gains access, they can't get the keys out. Or can't use the, you know, can't use the thing. Again, good crypto hygiene. Don't use the same key across all of your cars, like some OEMs have done. But, you know, this hardware stuff basically helps enable some of the higher level, protocol level kind of security, like doing authenticated CAN. So there's a thing called AutoSAR, which is, like, a software and it's open standard software initiative or something I've had and I'm forgetting what it stands for. I should know that. Yeah, but anyway, it defines, like, a protocol for doing secure authenticated communication on CAN. And also authenticated diagnostics. So there's not any kind of specification for this right now, but OEMs, this is all OEM proprietary stuff, but, you know, what the industry is working on basically is enabling, you know, much better authentication for diagnostics. So instead of, like, having a tool that has all the symmetric keys in it and, you know, being able to have access there, you have to go out to, like, an actual server and it sends, you know, some signed piece of information that you can verify with a public key. So, I'm gonna do one on time. So, on summary here, bootloaders give you powerful access to automotive ECUs. We started adding OTA to these things and it's making everyone's lives really difficult. But it's keeping us all employed, so that's good. But yeah, it really opens up the attack service for remote exploitation. It's making, you know, it's the enabler to be able to do updates and to push security patches and things like that, but it makes stuff extremely difficult. I think automotive vehicles is one of the most difficult things to do OTA on, because it's this big thing that's moving that could smash into something. And then, of course, you know, we're working on this, we're working on securing the ECUs, but are we doing it fast enough? Are we ever there yet? Of course the answer is no, we're still working on, still working on that. It's improving all incrementally, of course. So, thank you.  Bye.


I'm Alex Gessner from the University of Tübingen and I will present our recent work on gradient inference with Gaussian processes carried out with my collaborators Philippe de Rours and Philipp Henig. By the end of this video you will see how Gaussian process inference with gradient observations can be made efficient in high dimensions. Let's consider a standard Gaussian process regression task. We want to learn a mapping from d-dimensional input to a scalar output using n evaluations of the function f. Standard GP inference has the well known scaling that is cubic in the number of evaluations n for computation and quadratic in memory. GPs can also be conditioned on gradient observations. They increase the computational load to cubic in evaluations and dimensions and quadratic in both d and n for storage. In other words, one gradient evaluation is equivalent to d-function evaluations in terms of hardware constraints, but it only provides information about the function at a single location. Because of the high cost, gradient observations in GPs are not very common, especially as the dimension grows. In this work we show that gradient inference can scale linearly with the dimension both in terms of computation and memory. The high level takeaway is that one gradient observation can be cheaper than d-function evaluations in high dimensions. Let's see how this works. It turns out that the kernel gram matrix for gradients has a lot of structure for many popular kernels such as stationary or dot product kernels. On the left you see such a clearly structured matrix for three gradient observations in 10 dimensions using the RBF kernel. The structure originates from applying the product rule of differentiation on the kernel. On the right is the same matrix decomposed into its constituents. This decomposition is beneficial to use together with the matrix inversion lemma. Instead of inverting a dn by dn matrix on the left, we now only need to invert a chronicle product with an n by n, that's k here, and a d by d matrix that is typically diagonal for the RBF kernel that's the length scale matrix here. And further we need to invert an n square by n square matrix. The decomposition can be used to significantly speed up the inversion of a matrix when applicable. I would also like to point out that several of the matrices contain a lot of white space. We can use the sparsity to further speed up the computations of the woodbury inversion. The proposed decomposition is useful when the number of observations is smaller than the dimensionality. You can see this in the figure where lines that lie below the horizontal black dashed line indicate that the decomposition is faster. For d much larger than n it can lead to significant speed up. In the paper we also show how it is possible to avoid building the gram matrix explicitly and we apply these improvements to algorithms for optimization and sampling. I hope you are now convinced that dp inference with gradient observations can be made efficient for high dimensional inputs. Thank you for listening if you got interested and want to learn more about the technical details and example applications we invite you to check out our paper and the code repo that you can find linked below.


From Soldiers Radio and Television, this is the Army Now. Receiving a care package while deployed not only boosts morale of our troops it reinforces a special connection that service members have with the American people. From our dining room, Deborah Powers Holloway and her volunteers with Steel Magnolia's ministries have provided care packages and letters to more than 5,000 troops. Now they're making dream vacations come true for service members and their families. We've been blessed to give away 240 seven night luxury villa stays to our military veterans, wounded warriors, and two families of the fallen.  They're the home front heroes. Just goes to show that you do not have to wear the uniform to support the military. You have something to give to those who would give their very life for us and we just really love our military and we support you a thousand percent. From Arlington, I'm Captain Kyle Key with the National Guard Professional Education Center. That's the Army Now.