Maintenant, let's have a look at our STM32 trust global security ecosystem offer, what it is and what it provides. In the next 30 minutes, I'm going to provide you a brief overview of the STM32 trust offer, followed by some customer examples and use cases describing their key security needs. Before to look at the 12 security functions, which we have defined and which are supported, both by hardware resources and software packages, all across our product portfolio. Then we'll focus on two reference package solutions to support secure firmware install and secure boot and secure firmware updates. And finally, I will conclude with the key security evaluations and certifications that we are running to assess the robustness of our offer. So now let's start with a brief overview of the STM32 trust, what it is and what it provides. Well, with the increasing number of connected devices, there are more challenges associated with devices security to protect the firmware, to secure the user data or to secure the communication. Hence, to help developers to tackle those challenges, the STM32 trust offers a robust multi-level strategy to enhance the security of your product design using our STM32 microcontrollers and potentially STSafe secure elements. So basically, the STM32 trust is our security framework combining our knowledge, our software ecosystem, and the security services of our microcontrollers. The solutions offer a complete toolset for code and execution protection, it ensures IP protection, data security, and that validated credentials are used and it also helps to grant a firmware authenticity and secure firmware update. Finally, the STM32 trust brings 12 core security functions to align with customer use cases and security standards as well. So now let's review some customer examples and security use cases. We'll talk about six typical use cases to describe the key security needs of most of our customers. First example, Bob est CEO of a company designing toys developing both the hardware and the firmware. And he would like to make sure the firmware developed by his team is protected from theft and would only run on the hardware developed by his team. So basically, he wants to avoid any cloning of his devices. To achieve this, Bob needs to ensure that the firmware is not stolen during production and that there is no overproduction of his devices. So there is a need for secure manufacturing to secure the installation of his firmware by entrusted third party and to control the production quantities. He also wants to make sure the firmware is not stolen on the field and can't be extracted or modified. So he needs to protect his firmware IP and to secure the update of his firmware throughout the device lifecycle. And finally, he needs to detect and lock possible attacks in the field to prevent tampering with his devices. Second example, John est at the head of a company selling firmware IP that provides specific features and receives royalty payments from its customers. The firmware developed by his team is very valuable and features configuration options that can be further enabled by the user. To secure his business, John needs to isolate and to protect his firmware IP from customer ones so that it can't be extracted and copied. He also needs to ensure that he can securely update his firmware IP independently of the customer one. And finally, as his firmware provides also configuration options he wants to make sure that those options can't be enabled by customers without related payments. So he needs to define interchangeable application states to securely protect and lock these options. Third example, Marc sells very expensive equipment which are not replaced very often. So he wants to offer a firmware update service for instance to upgrade the product features over time. But he wants this service to only update his equipment and cannot run on competitors one. And he would like also to make sure only his firmware runs on his equipment and to prevent a third party firmware to be installed on his equipment which could generate some bad behaviors. To achieve this, Marc needs to identify and authenticate his equipment into which he will deploy his service. He also needs to implement a secure firmware update in order to check the integrity and authenticity of new software released before to install it. And finally, he needs to implement a secure boot to check the authenticity of the firmware running on his devices. Fourth example, Oliver is selling devices that report sensitive data to a central server. Oliver needs to make sure the data cannot be exposed to people outside of his company and that it is protected. To reach his objectives and make sure the data remains secret while being transmitted to the central server, Oliver needs to enable end-to-end secure data communication between his devices and the central server. So he needs to encrypt all the data communication in order to guarantee the integrity and confidentiality of the data exchange and store locally without exposing the encryption key so that nobody can decrypt the data. And he also needs to identify and authenticate the devices and the server exchanging this data to make sure these are the right devices talking to the right server so that devices are not transmitting data to unknown parties. Fifth example, Rose controls her fleet of devices from a remote server. And she wants to be sure no counterfeiting or malicious devices are running with her server and would like to have full control over her devices. To achieve this, Rose needs to check the genuineness of her brand devices so she needs to be able to authenticate these devices with unique identity which has been previously and securely personalized during manufacturing. She also needs to secure the communication between our devices and the remote server in order to protect the data exchange. And finally, she needs to ensure the unique identity and access rights cannot be changed with secure storage and secure personalization of these secrets. Sixth and last example Jack is collecting user data within his devices as part of a larger system. Jack devices and system needs to be in line with regulations such as GDPR to be able to promote and sell devices. To comply with this Jack needs a secure boot to ensure the integrity of the platform collecting and storing this data in order to avoid malware to expose them. He also needs to enable secure data communication between his devices and his system in order to ensure data is not exposed while communicating. And finally, he needs a secure storage to ensure the confidentiality of the user data which are collected and stored locally. So when we look at all those customers' examples and use cases, what we can see is that there is a common set of security functions which are required to secure all those customers' products. So that we have defined a list of these security functions which we have also mapped across our product portfolio. Hence the STM32 trust brings 12 security functions to align with both customer use cases and security standards. The STM32 trust brings also all the assets, documentation, software, tools to cover the 12 security functions which are listed here below. So starting on the right, the two first security functions are secure boot and secure and sell and update which are needed to ensure the authenticity and integrity of a firmware before executing or programming it. Then we have secure storage to secure store sensitive data or keys inside the device. We have also isolation which is the function to isolate trusted and non trusted parts of an application from each other. Then abnormal situation on the link. For example, when tamper is detected to erase backup registers and help to design to process cryptographic algorithms typically to encrypt sensitive data and to secure data communications. Let's continue on the left with audit and log to keep trust of security events like how many unexpected resets or reasons of the last reboot of the device. Then we have identifications, authentication, attestation which is the function to prove the unique identity of a device or software to any server or application. Silicon device life cycle which typically allows to control the ability to debug or to access the flash content from when the device is manufactured or put in the field. We also have software IP protection which is an important function to protect the software IP against unwanted external or internal reading and against any manipulation of this software. Then secure manufacturing which provides the ability to secure the installation of the device firmware by untrusted sort part factory and to control the production quantities. And the last one, application life cycles to be able to set and lock un changeable application states typically to protect configuration options. This slide I won't commentate. Later on you can refer to this one and take the time you need to review the summary definitions of those 12 security functions which is basically the summary of what I have just said before. What is much more important and more interesting is to look at this table where you will find a mapping of these 12 security functions across our STM32 and STSF products portfolio with highlight of the features supported by the silicon or by the firmware and the link to our reference solutions. Starting on the left side the first part is for our standard STM32 MCU series based on ARM Cortex M0 M3, M4 and M7 And here you can see in the first sub-colon that those products support most of the 12 security functions by the silicon itself and then in the second sub-colon you will find the firmware packages we can provide as part of our ecosystem to help you to implement these functions. So things like the SBECQ reference implementations for secure boot firmware updates key management services on L4 for secure storage the crypto libraries and finally the SFI solutions for secure manufacturing in combination with the STM32 hardware security module limited to H7 and L4 only for time being. The second part in the middle is for our application processor STM32 MP1, MPU series with dual Cortex A7 and Cortex M4 Again, the silicon itself can support most of the 12 security functions but many difference comes from the firmware packages this time it supports a ROM secure boot with OTP keys to authenticate and start the first stage boot loader based on ARM trusted firmware for Cortex A we can also provide OptiSecurityOS which is an open source portable trusted execution environment to manage security services such as secure install and secure update secure storage code isolation crypto enjine and IP protection as well and finally we can also support secure manufacturing with secure secret provisioning in combination with STM32 hardware security modules The third part is for our latest STM32 L5 MCU series based on ARM Cortex M33 processor which provides enhanced security thanks to trust zone and ST security implementation so this product support all the 12 security functions by the silicon itself and combine with ARM trusted firmware for Cortex M this is a unique platform supporting all the functions like secure boot and secure firmware updates with TFMSBSFU and then finally the fourth part is for our secure elements family not as an alternative but in addition to all of these products you can add header, STSafe, A or our trusted platform modules to enhance the robustness of some of the security functions both devices providing state of the art security based on smart card technology now let's focus on two of those security functions to see how they are supported across our products portfolio in more details so the first one is secure boot function which you are aware of now to help you to implement these functions in your next product design we can provide three different code examples header the xcube sbsfu reference implementation typically for standard STM32 L4 then the trusted firmware for Cortex M version for STM32 L5 with trust zone and finally the trusted firmware for Cortex A version for STM32 MP1 with first stage secure boot loader to implement this secure boot the three firmware packages leverage the hardware resources of the targeted platform like read protection write protection and memory protection unit on standard products like STM32 L4 unique boot on tree and high protect on US products like STM32 G0 G4 and L5 or memory management unit and secure boot ROM on STM32 MP1 application processor and finally as I did on the previous slide you can enhance the robustness of the secure boots by adding the STSafe secure element to store the certificate used in this process the second one is secure manufacturing of your devices to help you to implement these functions we can provide the STM32 hardware security modules which is effectively a smart card that you can use with the STM32 cube programmer to generate and store the encryption key and in combination with the SFI secure firmware install service to secure the programming of STM32 in understood environments this SFI service leverage the RSS root security service on the STM32 H7 L4 and L5 and the secure boot with secure secret provisioning on the STM32 MP1 then for the products which don't support those silicon features we can provide a fast-run programming services in our factories for all our STM32 series except the STM32 MP1 subject to minimum ordering quantities and added cost so it means we will program your firmware and set the option bytes of the device in our factories before to deliver the part to you and finally you can also add the STSafe secure elements already pre-personalized with customer certificate and credentials now some more content detail about these two reference package solutions to support secure firmware install and secure boot and secure firmware updates in particular how it works so as previously said secure firmware install solution provide protection when devices have been programmed for the first time in untrusted environment current issue is that customers have to transfer their firmware unencrypted to a third-party manufacturing to get their devices program while this factory is not necessarily trusted this solution offers a complete tool set to encrypt the firmware safely transfer the firmware and customer credentials to the programming partner and to securely flash the STM32 so how it works after firmware development and validation developers can use the trusted package creator software to encrypt the firmware and also to store the encryption key into the STM32 hardware security modules on the same way it can be used by a third-party IP provider to encrypt their own software IP then you can safely transfer both the encrypted firmware and the encryption key protected by the physical STM32 hardware security modules to the untrusted factory finally using header the STM32 cube programmer one of our recommended partner programming tools with the right security features Gainwing STM32 will be authenticated the firmware will be decrypted and securely flashed with control of the production quantities so the programming tool first authenticated Gainwing STM32 thanks to its unique keeper previously programmed by ST establish a secure channel to safely transfer the encryption key from the STM32 hardware security modules to the STM32 and also transfer the encrypted firmware to the STM32 hence both the firmware and the encryption key are never seen uninterrupted outside the STM32 then inside the STM32 the firmware is decrypted and programming the flash and the option bytes are set to ensure that it cannot be read back on top you can control the production quantities so if the STM32 hardware security modules can be configured to generate 10,000 units of installation license you will be able to flash only 10,000 units of STM32 for secure boot and secure firmware updates as you have already seen we provide the X-Cube SBCFU solution which is a set of software reference source codes for secure execution and the bread of STM32 microcontroller building applications it includes 3 software modules the secure boot checking the authenticity and integrity of user application code before every execution the secure engine providing a protected environment managing the critical data such as firmware decryption key and performing the cryptography operation and the secure firmware updates receiving the encrypted firmware image decrypting it then checking the authenticity and integrity of the new image before installing it the X-Cube SBCFU also shows how to set up all STM32 memory protection mechanisms to isolate secure boot and firmware update functions from the main application and there is also a reference implementation with the STSafe secure elements to enhance the robustness level of the final implementation Another very important point when talking about security is related to the evaluations and certification of the devices and the reference software implementations that we are running to assess the robustness of our solutions Main propose of this is to provide to our customers evidence that they can trust the security of our hardware and software solutions for developing their products and potentially to reuse the evaluation results to pass their own application specific security certification if needed to address their markets such as PCI for port of sales application or IOC62443 for industrial applications So there are a couple of standards particularly important and which we have decided to follow First standard is CESIP which is the security evaluation standard for IOT platforms issued by Global Platform Association which is recognized worldwide for its security standards and certifications This standard describe the security functional requirements and the security assurance requirements of an IOT platform and let's say that CESIP is the first certification methodology well adapt to MCU product Here as you can see the STM32-L476 in combination with the X-Cube SBSFU package is the first GPMCU platform to pass CESIP level 3 certification which is the assurance to sustain a wide box time limited vulnerability analysis The certificate displayed here is also available on trustCB website Important to note STMicroelectronic is the first company with such certification level on GPMCU Second standard which we follow is PESA certification which is the Arm Based Security Assurance Scheme for IOT devices and services The security certification provides 3 progressive levels of assurance and robustness while the functional API certification provides a set of easy to use built-in security functions Here as you can see the STM32-L5 in combination with TFM is the first GPMCU platform to pass PESA security certification level 1 & 2 and PESA functional API certification The certificate displayed here is also available on PESA certified website Again important to note STMicroelectronic is the first company to receive PESA level 2 certification on GPMCU This table summarise all the evaluations and certification we have got so far For Arm PSA we have the STM32-L4 and the STM32-L5 certified PESA security level 1 and the STM32-L5 in combination with TFM certified PESA security level 2 and compliant to PESA functional API For CESIP the STM32-L4 in combination with Easecube SPSU is certified CESIP level 1 & level 3 et très récently we have got also the STM32-L5 in combination with TFM certified CESIP level 3 Then on top of the Arm PSA and CESIP certifications we also have the STSafe Secure Elements which are common criteria certified at a banking level for state of the art security and finally we have also demonstrated the possibility to build a system on chip solution based on the STM32-L4 fully compliant to payment cart industry standards for point of sales applications I will now conclude with some takeaways and key points to remember from this presentation To summarize this presentation the STM32 trust security ecosystem is a unique and certified one stop shop solution helping you to implement security in your new product design Starting from customer use cases and security needs we have defined a set of 12 core security functions which are the foundation to fulfill all the common security needs These functions are implemented and supported across our product portfolio using our STM32 microcontrollers and potentially our STSafe Secure Elements and we also provide reference packages for seamless implementations of a secure boot and secure firmware updates or for secure manufacturing of your devices and finally we have evaluated and certified our hardware platforms in combination with reference software packages according to new security standards being the first on the market certified PEC level 2 and CZP level 3 so that at the end of the day customers can really trust our deliveries to secure their product that's all for the STM32 trust security ecosystem presentation further information are available on our website thank you very much for your attention


Welcome to day four of SHA 2017. Are you enjoying yourselves? Tonight we have car hacking, getting from A to B with Eve. So I saw a Tesla standing outside the parking lot, and I thought to myself, like if he says to Wally, directives, enjoy your talk. Thank you. Well, thanks for being here. About our talk about car hacking and our adventures in car security. So I must first start with a notice that we currently are still in the disclosure process, unfortunately, which means that we cannot give a full detail on what we found, so no full technical detail, nor are we able to tell which manufacturer this all appeals to. And yeah, so no fancy Ida screenshot or whatever. So that's unfortunate, but that's the way it is. So my name is Dan Koeper. I'm a security researcher at Compitest. Today with me I have Thais Alkamada, also a security researcher at Compitest. And we both spent a lot of our time on R&D projects, so not directly affiliated to work for customers. What we do for customers is we test, we verify their software quality, and we do that on a security base, performance base, and functional testing, where we of course are focused on the whole security department. So at Compitest we have a specific lab, which we call the Chaos Lab, and the Chaos Lab is our resource lab where we get to spend time researching projects that we deem interesting, and they will often have, well, will be beneficial for either society or the community. So you might know us from some of our previous work. The most famous thing we did was last year we found a vulnerability in a let's encrypt clone, which allowed you to get free SSL certificate for domains names like Google.com and GitHub.com. And we published vulnerability about Ansible, how you could own the farm if you compromised a single host in the network. That being said, one of our colleagues said, why don't you hack a car? And we're like, okay, let's just give it a go and see how that car, how it goes. The reason we try this is that cars are less about hardware than they used to be. They're currently more focusing about onto software. And also more and more cars come with Internet connectivity nowadays. And we all know that the Internet of Things is a fantastic thing that makes the world a better place. So we thought, let's give it a try. So I looked up some quick statistics, and apparently in 2015, 35% of all cars have some sort of Internet connectivity. That can either be direct or via a mobile phone. The problem with the current eco structure is that these cars will still be on the road in 2030, most likely. And most cars will have a lifespan of 15 years or longer, meaning that vulnerabilities in the current cars will be there for the next 15 years, which makes this whole thing a little bit frightening. And experts estimate that in 2020, almost all cars will come with Internet connectivity in some way. So with that in mind, we set some research goals for ourselves. We wanted to find a remote attack. So an attack that required no user interaction at all. So no ODB ports or a user has to visit a website on their infotainment system because they use an outdated WebKit, et cetera. The goal was fully remote, no user interaction. And from there, try to work away up to the canvas, especially, of course, the high-speed canvas that controls things like steering and braking. Oh, yeah. Also, a very important thing was to keep away from any legal fights because we're only a relatively small company if you compare us to all the car manufacturers, so we didn't want any legal issues. So keep it legal. We are a consultancy firm, which means that almost everybody in our company has a lease car, which means we had about 85 cars to choose from. And phase one was to select which cars have the largest remote attack service. So I sent on the email to all employees, okay, so who here has a car that also has a mobile app? Because if they have a mobile app, then it will also have Internet connectivity in some way. I got about 12 responses saying, yes, I have such a car, and they all said, but the app is shitty. I never use it. So I would like to do a small test here. Who here has a car that also has a mobile app? Who is actually happy with that app and uses it on a regular basis? Wow, that's one. Okay. So they want to connect the thing to the Internet, but the user interface sucks, so actually nobody uses it, but okay. So we have 85 cars, and people can choose their own lease car in our company, so that will mean that we also have a very different variety of cars. So all the cars we tested were different brands, different models, etc. So if we look at the attack service that a car has, the typical attack service, the most cool way is, of course, if you have a cellular attack. There's some attack that works remotely via this cellular interface that your car probably has. Some cars also have a Wi-Fi hotspot that you have to enable. Slightly less cool because then you have to be in the, you have to be nearby. TPMS, the tire pressure monitor system that's used for your car to monitor your tire pressure, because apparently it's very difficult to connect a cable to something that spins with 130 miles an hour, 20 kilometers an hour, sorry. So that's also something that works wirelessly, so an attacker could potentially drive next to you and try to hack your car via TPMS. Obviously you have Bluetooth, and then you have some factors that require physical access. So for example, the user has to insert a USB stick or has to connect something to the ODB port, which is your debug port basically for your car. So we started by looking how each car connected through the internet, and it seemed that there are different ways car manufacturers connect their cars to the internet. Some cars use some sort of embedded SIM cards, which means it's basically just embedded in the hardware, which makes it difficult to test remotely because you have no influence on the ISP the car is using. So you cannot man the middle of the connection because the ISP is probably netting everything, you cannot get on the same network, you cannot do a port scan, etc. So the embedded SIM is pretty difficult to do remote research on. Then you have cars where the user has to insert their own SIM or where you can replace the SIM of the manufacturer. That makes it slightly easier because then you can insert your own SIM, which gives out a public IPv4 address. You have cars that have no internet accent by itself, but use Bluetooth deethering. So if you ever hook up Bluetooth pairing with your car because you want to use the car kit, for example, it will also use the internet connection to get, for example, maps data, etc. We actually also saw a few cars that do have an app but don't feature internet connectivity. What they do is they have a local Wi-Fi hotspot, and if you want to use the mobile app, you first have to switch to their Wi-Fi network, which is very inconvenient, of course, and then you can use the app. Some of those apps also do firmware upgrades this way, which means that the app actually also has a copy of the firmware from the Wi-Fi chip in the car, which is, of course, for reverse engineering, very convenient. So use the Wi-Fi function from your telephone as a hotspot, so not Bluetooth, but you have to set up a Wi-Fi hotspot with your phone and then your car can connect to the internet. We saw some cars that no matter how you connect them to the internet, they will always set up a VPN tunnel to the manufacturer. So all traffic will always be encrypted end to end. It doesn't matter really if they're using their cellular network or if they're using the Wi-Fi hotspot on your phone, they will always set up a VPN tunnel. So inside your car is the CAN bus network, and that's where we want to be. The CAN protocol is eventually the protocol that allows you to unlock your doors, control your air conditioning, but it also currently is used to activate your brakes and to control your steering. For example, if you have adaptive cruise control, the car needs to brake if it sees another car in front of you. So there's a radar system in your car, and if it detects any obstacle ahead, it will send out a message to your brakes over the CAN bus, after which your brakes will automatically apply. Same control goes for steering. Some cars can auto park or have lane assist, which will keep the car between the lines. That also goes through the CAN protocol. So the CAN bus typically comes with rings. So the car manufacturers figured out that, okay, so having one big network that controls everything, that might not be a good idea. So they separate the CAN functionality in separate rings. So you have a low-speed CAN bus, which is used for convenience features, like opening up the windows, setting up the air conditioning, etc. And the high-speed CAN bus is used for everything that is critical for the car functioning, like the engine and the brakes, etc., etc. Obviously, if you're on the low-speed CAN bus, your messages should not end up in the high-speed CAN bus. That's the whole idea in general. So the CAN bus protocol, yeah, it's a bus. It's not like Ethernet. You don't have a sender or receiver information. Yeah, so it's just a bus with high volume of messages that you have no idea where the messages are coming from or where the message, for who the message is. Each message has an ID, which is an 11-bit field, and then some payload, which contains some data. Everything else is not standardized, actually. So what ID means, what? You have no idea. What each payload means, you have no idea. So it's very difficult to get a grasp on what each message actually means, because you have a very, well, if you actually log it to a file, you have a very big file within seconds, with only bits that you have no idea where they're coming from, who's actually interested in receiving those messages and or what the payloads are. Of course, it's all binary data. So to actually figure out what message has which action as a consequence, that is a very time-consuming task, and usually involves a lot of trial and error. So when we started out this research, I was really oblivious about car security. I didn't know anything about car security, actually.  Please apply the brakes. Apparently, it doesn't really work that way. Cars have a lot of security built in, and they will not break without any, well, very specific reasons to do so. So if you're on the Canvas network and you spoof the message from the front radar, that will most likely not work due to all kinds of security mechanisms.  You can just keep going.  So attacking the high-speed Canvas is a whole nother research topic on its own and also a lot of work. So it was clear that most car manufacturers will actually separate the internet connectivity from the high-speed Canvas in some way. But of course, the app needs to control the actual hardware in some way, because in most apps, you can do things like lock or unlock your door or control the air conditioning. So there has to be some link between the cellular connectivity and the actual Canvas to make that happen. The component that connects the car to the internet varies between models. In most systems, the IVI system, which is the infotainment system, so your satnav or radio, will actually house the internet connectivity. And most cars will also have what they call a Canvas gateway. The Canvas gateway is a separate hardware module, and its job is to restrict messages from the low-speed Canvas to the high-speed Canvas, because some messages need to go from the high-speed Canvas to the low-speed Canvas. For example, you want to have motor information on your IVI system. You have a car section and will give out error messages, for example, so change your oil or something. That's typically something that will go from your high-speed Canvas to your low-speed Canvas. And the Canvas gateway is required to filter that messages, et cetera. It's not always the case that the IVI system will also have the internet connectivity. In some situations, the cellular network will have its own line on the Canvas, and it will be a separate hardware component in the car. Or if you look at the car that Charlie Miller and Chris Velasek attacked a few years ago, there are actually the infotainment system was connected to the internet, and the infotainment system was directly connected to both the high-speed and the low-speed Canvas, which is for a security standpoint of view pretty much a bad idea. Yeah, we started out by looking at the infotainment systems because they were most likely to connect the car to the internet. And we were looking for a remote software-based attack. So, virtually now, we have to continue to the next slide, skipping some details because of this closure process. But at some point, we got roots on the IVI system via our Wi-Fi hotspot. So, it was not remote-remote, but the car had to connect to a Wi-Fi hotspot at first, but then we got roots on the IVI system, which was, of course, a first step. So, well, maybe steps at a time. I will give the words to Thijs, my colleague. We'll guide you to the next presentation. Okay, so we had a root shell on a car, and then we started to look around for common tools to find out other things about the system, and then we noticed there's nothing there. None of the tools that we would normally use to explore the system were there. So, we had nothing to work with. We could find out that it was running QNX, which is a real-time operating system, which is somewhat Unix-like. If you don't look too closely, you can just pretend it's Linux and then ignore that part. So, we had to invent some creative ways to do discovery on that CPU that we hacked. So, we could run iFconfig, I think, and we did find out that there was an internal network on the car. So, there must be something else out there, we think. So, we started to do some host discovery first. We just ramping instead of M-Map to find out which host was responding, and then we started the script to do a port scan by using FTP. So, by just trying to FTP to every port on the IP address that we found, we eventually got a complete picture of the other device on that network, which was a very annoying process, because every time it found an actually open port, we had to restart or manually close the connection and then let it continue, and it was really slow. So, we came back after a weekend, and then it processed three more ports, and then that found something open, and then we had to start it again. It was a very time-consuming process, and we had really not much information about what we are actually working on. Our current theory was that we had a CPU that was connected to our Wi-Fi hotspot, which was connected over Ethernet to something else, but we didn't know what. So, our hope, our assumption was that the CPU-A was connected to the cellular network, which was used by the app, but that was still an assumption at that point. We looked at some of the binaries, we dug around through the system, and we did find some references to text messages to SMS, so that might be it. There were some references to specific pieces of hardware that can be used to send out SMS messages. So, our theory then was that it was using SMS to update status, because we also found out that there was quite a long delay. You had to push refresh in the app, and then it was waiting for a minute, and then you saw the status of your doors. So, SMS might actually be plausible for something like this. So, there was still net running on the other device we found, so the other thing in the network, and then we thought, well, maybe it has the same password. We didn't know the root password yet, so we looked at what we had, and luckily it was encrypted to a desk script, so for about $100 we got to get the password in like three days, and then we thought, well, we need more tools there, so we signed up for a trial license for QNX. So, this is a commercial company that develops this, and you can request a trial license to evaluate it. So, after we filled in this form, they contacted us, and by email and by phone, they were asking, well, probably wanted to ask what we're going to use it for, but as we didn't really want it to say, well, we're going to hack this car, so we just didn't answer. And then they just, after a month, they sent the trial license anyway, so then we got the tools. So, at least we could now compile things for the device we were working with. We had some pre-compiled binaries that we can put on there. So, then we had Telnet. So, we tried to connect. We had the password, and it was wrong. So, okay, let's try something else. Let's brute force the password. How hard can it be? Well, no, that doesn't work. It crashed a lot. It may be a real-time operating system, but it doesn't mean that it can't crash or hang in different ways. We had to reboot that car quite a few times to get it to work. And then, it was clear this process wasn't working. Well, what it turned out to be was that the Telnet binary that we got from those tools was broken. So, we had to compile one of our own. And then, yes, it did accept the same password. So, both of them have the same root password, and we got access to that other CPU. And then, later on, as we were exploring the system more, we found out more things about QNX, because we had no idea what it was. Well, it turns out that there's a specific QNET protocol, which QNX devices can use to communicate. And this sort of like a file system, file sharing service, but it basically means that if two QNX devices are in the same network, then they can mount each other's complete file system inside their own file system. So, we had complete access to the other device, but we didn't know it. And actually, they can start processes on each other. There are actually commands to run a command on the other processor. And we found that out only much later. So, it was clear that these two CPUs were not a security boundary, because the same password, you can start processing both of them, and they both had Telnet open. So, what were they used for? So, our theory was that CPU A was for controlling the multimedia system, the UI, the device, and connecting to speakers, and that sort of thing. And we were also sure that it was connected to the Wi-Fi, and that CPU B was handling the low-level communication with the car. So, we dug around there, and we also found some references to specific hardware, but nothing that really seemed to influence the connection with the app. So, we were busy working on this for weeks, and at some point, we moved the multimedia device from the car, and then I checked the app, and it was updating. It was still working, even though we had the device disconnected from the car that we thought was handling this communication. So, it was clear that there must have been some other hardware device in the car that was handling this communication, and later on, we found out where it was, and it was completely somewhere else, and related to the device we were hacking. So, we realized that there was another hardware component, and as we didn't have firmware or anything, well, we decided, let's try a different car. So, there was somebody else in the company with a car with very similar infotainment system, but it did have the option to supply your own SIM card. So, what the situation is there is that we definitely have CPU A connected to the internet, and then connected to the other device, but then we got into the challenge of trying to get access to that from the internet. So, we know that this car can connect to the internet, but can we connect back? Well, most carriers these days use carrier grade net so that you don't get a public IP address. So, we had to use a very specific SIM card to get a routable IPv4 address, but when we did that, we could get access to it remotely. So, the car had a public IP address, we censored it and it's wrong, so ignore that, but we could connect to that from the internet to the car, and then use something we cannot disclose yet to run our own scripts on the car. There's nothing modified about this except for plugging in one SIM card into that car. So, if you know that IP address or if you scan the internet for specific open ports, you might be able to find cars like this with a specific SIM card. So, this might sound very bad, but there really were some defense mechanisms that we found that really indicate that security is a concern for cars. There is a firewall running on the device, but it wasn't enabled for all interfaces, as you can see in the previous slide. And there are cryptographic signatures that are used in the protocol to install updates on the car. So, here are some other things that we may have been thinking about doing, but did not do, certainly not. So, you should not request a test drive and then drive around the corner and try to see if you can do that on the car as well. You should also not go to showroom, plug in your laptop into a car if nobody's looking and then try to see if you can also do it there. You should definitely not do that. But there may be other devices where this might work. Maybe other models of cars with similar infotainment systems. So, how do you get from there? We have root access to the CPU A to CPU B, but how does that control the car? Well, we know that there is a gateway and there's also a separate chip on the multimedia system that controls the access to the canvas because the CPUs are not directly connected to the canvas. There's a canvas chip that limits what messages we can send to the canvas from the infotainment system. So, how could we gain access to that? Well, we could look for an exploitable vulnerability by just sending stuff to it, but that would be a lot of work. We could drive a mechanic or prepare the car, specifically to dump any USB sticks that are plugged into it and then send it to us. Although, according to our lawyer, we should definitely not do the last two of those. And we didn't get very far with that currently. So, we currently know that we can own the first CPU, that the second CPU can be owned, but whether you can attack the canvas from there, that's still theoretically at this point. So, as we're currently working on this, we're using canned sniffers before and after the gateway. We're trying to see what messages can we send from the canvas from our infotainment system and how do they look like and what do those messages do? So, what can the infotainment system actually control? So, what could we do as an attacker? And then we dig around a little more and even though at the start, we said, well, a cellular attack would be the coolest, we found something else. You can plug USB, you can plug USB devices into your car. That's gonna be a phone or a USB stick with music on it. But there was one specific identifier that looked for, it was kind of weird. It was doing something it didn't do for anything else. So, what did it do? It started a Ethernet over USB interface if you plug in a very specific USB Ethernet dongle. Well, guess what the firewall is like on that interface? There isn't any. So, if you have a USB stick that may not be completely trusted or if somebody has a phone with malware and they plug it into your car, then they may be able to start a network interface over that and then gain access to your car and then do whatever malicious thing they want to do. So, we currently have a remote attack against the IVI system, which gives out your GPS location, for example, which controls, of course, whether it's on screen, what's on your speakers, and which also can activate the microphone. So, an attacker could listen on the microphone to everything you say in the car. The Canvas chip that Ty spoke previously on which didn't allow us to send arbitrary Canvas messages, we found out that that is most likely unsigned. We have some specific, very clear indication that's unsigned. So, the next step in attack would be that we reflash the chip so that we can send arbitrary Canvas messages. But of course, for that, we need the firmware which we cannot obtain legally. So, maybe with some help with the manufacturer, we can get a copy. So, the IVI system is shared between models. So, the impact we have is broader than the model that we tested this on. The remote attack works sometimes. That, for example, depends on the version of the infotainment system that you have in your car, because there are different models, different versions. And what we saw that the USB attack, so suppose you have malware in your phone, you plug it in to your car, that will always work on all models that we have tested. So, what is next? Well, we are currently in the responsible disclosure process. The manufacturer has been most helpful on this point. So, the next step would be to get a hold on the Canvas chip legally. So, we can flash the firmware with a backdoor version, which would allow us to send arbitrary Canvas messages. And of course, look more closely at the Canvas gateway, which definitely needs more research. But of course, we're also interested into looking at more cars. Because, yeah, if we've done with this car, we'd like to look at another car. We have learned a ton about car security. And so, yeah, if manufacturers would like to work with us, please drop us an email. So, there are benefits from having an internet-connected car. I mean, we also love the internet. We're all geeks of course. And we also know that we cannot stop the IoT revolution, that we will connect everything to the internet. So, and actually, we don't want to. And of course, it's also natural, logical that all cars will have an internal network, which will include braking and steering.  However, we think that, well, it's all software nowadays. And security vulnerabilities will always be a risk. And users are used to the fact that they have to update a laptop and their phone on a regular basis. But they're not used to that they also need to update the different components in their car. Most cars also don't have an over-the-air update system. So if you want to install an update for your car, then you have to drive to the dealer. And they will have insert, either plug it in with the laptop or have to insert an SD card. Most users will never do that, of course, or only once. So I think this is a problem that we can definitely fix for the car of tomorrow by supplying over-the-air updates in an automated fashion like we do for operating systems on your phone or your laptop. But we cannot fix this for the car that are currently on the road, of course. The current car is on the road, however, will be there for the next 15 years or so to come. And I also think that this is not a problem for the owners of the car, but actually a problem for everybody else who's on the road as well. Because I don't like driving next to a car that has remote vulnerabilities in them. So I think it's a problem that still needs a little bit more attention, especially for the cars that are currently on the roads and not the cars for the future. Okay, well, actually, that was this for today. We had to skip, of course, the demo because of the disclosure. So are there any more questions based on this? So in the middle are microphones. So if there are questions. Hello. Most of the cars have a diagnosis port. Yeah, correct. You know where that one fits in, which canvas, or where it is connected? Yeah, so the diagnostic interface is connected to the canvas on the specific diagnostic canvas line. So it's a separate line from the IVI system that we're currently on. So what we still would like to test is if you can send diagnostic messages from the current point of where we are currently are to see if the canvas of the Gateway will accept that. Because, of course, we need to check that to make sure that the separation is actually in place. But it is a different canvas line currently. Hi. I understand you can't really tell us anything about the remote vulnerability yet. But can you tell us anything about how you found it? Well, we found some... Well, we first looked at the Wi-Fi connection to look at what the remote attack surface was. We found out that over Wi-Fi there was quite a few open services. And then we dig deeper into each services and we could also find some information online or some reference stuff. From there on, we could work out how the system would actually work. We could eventually manage to get a full-working exploit. Thank you. Next question. Hi. You mentioned that you found the type number of the second CPU. Yeah. Did you actually physically look at the card to find out or did it report it in your command? Both. We could, of course, unscrew the IVI system and we look at the chips that were there. That also gives us some information about the rest of the system and how it works and how it operates. But once we had access, we could also check that using software, of course. Another question? One question. You exploited some undocumented feature. Did you do any ex... Look into, like, exploiting APIs? Like, the Tesla has a documented... Well, semi-documented way to retrieve car information through an API? Yeah. If you have the API key, which friends of mine really misused, but it was really funny. Did you do any research for that? Well, all the cars that we looked at didn't have a public API. So what they all did, they pushed their car status to the manufacturers and the app would connect to that same network. But none of the cars had an API of their own to connect to. You think it could be really misused? Of the API could be misused. If you supply an API on the IVI system, obviously, of course, yeah, of course. If it has vulnerabilities, or if you manage to get a hold of the API key to some other way, then, of course, you can not use that, yeah. Okay, thank you. So, thanks for your talk. I was wondering, you're not allowed to say anything now. Do you have a timeline for when you will be able to share your findings? Not currently. Well, we're in contact with the manufacturer and... Yeah, I hope I will get a timeline soon. But in this moment, well, we don't really have an idea. Hopefully in less than 15 years. Ha, ha, ha. Okay. Next question. Are you allowed to say whether you got to the internal fast Canvas or not? Well, that is still ongoing research. So we have CPU A, CPU B. We have an attack that will work on the Canvas chip, which, well, we are... Well, 99% certain that it will work if we have the firmware. The Canvas gateway, that is still some ongoing research that we're currently looking at. So what we're doing is with the two Canvas snippers on both sides of the gateway, we can look at which traffic flows through the Canvas gateway and which doesn't to get a map of which commands are actually allowed to send on a high-speed network. Other things that we're looking at, if we can send diagnostic information via the Canvas that we're currently on, maybe the gateway will accept that. And the best way, of course, would be if we can get a hold of the firmware, which might be possible. I have spoken to some guys and, well, it might be possible. Then if we have the firmware, then we can, of course, reverse engineer it and to look for specific vulnerabilities. And otherwise, we have to do that remotely, which is also possible, but a lot harder, but still possible, of course. Yeah. Another question. Just to qualify the risk, is it a broadcast attacker, or is it a single? Sorry. Is it a broadcast attacker, or is it a single device? Sorry, is it a broad? Is it a broadcast attacker, or is it a single device? So are you essentially picking off an individual card because you know that it's a VIP? Are you looking at an attack that you can roll out across an entire fleet of vehicles? Well, the IVI system is used between different models. So the attack is wider than the model that we currently look at looking at. I get that. But do you need to connect to an individual card, or can you essentially roll something out and roll from such a level? Yeah, OK. So the attack will, the remote attack will work on a percent of, I don't have the numbers, but will work on some of the IVI system, depending on which version it is. If it's a vulnerable version, the attack will work. However, you're most likely blocked by the ISP because most ISPs will use NET to prevent any, well, use NET for the IPv4 address. So you cannot directly connect to the car. And another option would be that you get a SIM card of the same ISP so that you can connect behind the NET to the car. Only for some ISPs, that is allowed. Here you have client-to-client communication from the NET.IP address. However, from most ISPs, at least in the Netherlands, this is not allowed. So you have no client-to-client communication. So I think for most users will be protected by the ISP, which is, well, actually, that's not where you want your security to be. You want your car to be secure on itself. So the car will work against the entire fleet, if, but with the limitations of that, you need an ISP that is allowing client-to-client communication or is handing out accessible public IPv4 addresses. Hi. So you said that every car has its own public IP address, right? No, that depends on the ISP. It depends on the ISP. So would it be possible to fingerprint a set of IP addresses to determine which IP addresses are cars? Yes, if you give me an IP address, I can tell you if it's a car or not. So I know from, of course, in biology, you have to capture and recapture a technique to determine how many species are within a certain area. And they tried that with their car vulnerability by scanning the internet. And then, sometimes later, rescanning the internet, see how many cars were still online. But that turned out to be completely wrong, that estimation. So we actually didn't do that for this research, because, well, we tried to focus on other stuff, getting deeper into the car rather than determining the number of vulnerable cars currently on the road. In general, I think, in the car, there is a network. Yeah? Is there not an encryption in this network? No. There's typically no encryption. The Canvas messages are most definitely not encrypted. And if you have internet in your car, it depends on the software stack. But in our case, the communication between A and B was entirely not encrypted. One moment you mentioned that something crashed and you had to reset something. I assume you didn't have to remove the battery from the car to do that, correct? No. To which level did you have to reset? Basically, reboot everything. I'm still not sure how to actually reboot it. It was just turn off car, wait for a few seconds, and then turn it on again. And then sometimes that rebooted the navigation too. So there was a button you could press for 10 seconds, and then sometimes that worked as well. And it was weird. Because, well, the IoT system will remain active even if you shut down the car. So it turned out, actually, within software, it was relatively doable to restart the car. If you have a shell, if you didn't have a shell, it was mostly pressing buttons until it worked. That worked about 95% of the time. Are all the exploits you found software patchable, or do some of the chips really need to be replaced? So the remote reliability, that would be software patchable. The not using signing on the Canvas chip, I think that will need some hardware replacement as well. So that's something you cannot easily fix. However, you can say, OK, that's accepted risk. As long as the Canvas gateway does a job, then that's OK. But the main vulnerability that can be patched via software, yes, but it cannot be patched over the internet. So you will need to go to a dealer. In what timeline will be the fixes slash patches available? Currently, I have no idea when the manufacturer will publish those fixes. So I have more questions. Over there. Wait, wait, wait. Just a small one. How many brands did you look at? How many brands of cars? I don't know the specifics, but more than 10. Is it models or is it brands? Oh, brands. I'm thinking, I think that's about the same. I think most also wear different brands, but also some models between. And your non-disclosure agreement was for one brand or for all of them? The disclosure process currently is we have a vulnerability and would like you to fix it. And not about brands or et cetera. OK, thank you very much. OK, thank you, Dan Köper and Thijs Alkemaade.


I'm just gonna go squad. Fun video today. Engaged edition. We can say that now. We can do some engaged-style videos. Is that crazy? And I've never heard of this video up until yesterday. Mariah actually brought it to my attention. Yes. Agree or disagree? Yes. We're gonna see if we have the same opinion on things and if we agree or disagree on the same exact things. Or if we have the same 50-50. Wait, when do I put up 50-50? That's just like, you're like in between, like an answer, like you have a reason for both. So it's like, does Mariah look good today? 50-50, no. Technically, agree is in disagree, so. So the reason I did these note cards was because I wanted it to be like legit. Like if I said agree and then Bill just went along with it, like I wanted to like actually get our answer and then show it at the same time. You cannot switch it. After you pick a card, you can't switch it. So in my head, I'm not gonna be like, oh, I disagree and then they're, oh no, I agree, yeah. But you might make a good point that makes me go on your side if I don't agree. So we're allowed to switch up? Yeah. If you're new to our channel, make sure to hit that subscribe button. Give this video a huge thumbs up. We appreciate all of your support. We hope you enjoyed the video. And make sure you guys are following us on Instagram because I ask you guys on Instagram to ask us questions for this video as to why I want you guys to follow us because then you guys can get involved. You guys ask some very juicy, good questions that are like super fun. We're always incorporating our YouTube videos with our Instagram stories. So you don't want to miss those. And if you want to be involved into our videos, which we want you guys to, make sure to just be commenting out below, showing some love and following us on Instagram. So anytime we ask you questions, you can actually tune in and be the decided factor. All right, we're gonna start off juicy because I feel like this is a good one to start off with. All right. If your partner is talking to another person that's the opposite sex, then it's cheating. Oh. I'm gonna do this, right? All right, disagree. 50-50. Ooh, wait, what? Okay, so you don't think that's cheating? No, not at all. Okay, this is how I view it. I'm 50-50 because it depends on the girl and the relationship. Like if you were texting Julia or Anna, I don't find that cheating because I know what's not going anywhere. But if you're talking to another girl, like texting and like having conversations, I feel like that's almost cheating because you're giving, it might not be physical, it's still the attention you're giving to the other. I'm changing my answer. Yes. 50-50 for me. Because I said disagree at first because I was thinking of like going out in public and talking to like, you know, a girl and I'm a guy. No, this is like texting. Okay, so if you're like texting, you're just talking. I need talking though. The thing is, it depends on the conversation. I think you should be able to talk to whoever you want, whenever you want, but depending on what you talk about and how the conversation plays out and how often.  Like, don't even, I got a fiance, obviously, but like, trust me, like you're awesome. No, don't do that.  Okay, but it wasn't like. You were entertaining it, but I just know girls. So I feel like I agree on that, but I'm also like I said on the other end because it's half and half. Trust me, I went out to a bar like three weeks ago. True story. And this girl, she was like rubbing up her words, let's just say. So like, you know. I wasn't there guys, I was home. Right when she left the bar, it was me and some other guys and she just like was going around to all the guys and like it came to a point when she was up to me and I told her, you know, I had a fiance and stuff because she was like, so are we gonna dance or what? And I'm like, I have a fiance like no and then she left obviously, but like that, if I entertained it. Yeah. Nope. Yeah. Do you feel like you rushed into getting engaged? That's a good one. A lot of people are asking this. I already know my answer. I already know that too. Ready? Disagree. All right, why do you first? I disagree because I feel like we've experienced everything about each other, we moved in together. I know it's un-traditional moving with someone before you get married, but we did it and I feel like we've been together for almost six years. So I feel like it was meant to be like, I was ready for the next step. Like I knew he was giving me a partner for life. I felt it, I could feel it. We've went through everything together, all the highs and lows and like we came out even stronger. So I knew you would be the person for me. So I don't- Yeah, I think that's awesome because I totally, my views are the exact same. I don't think it's wrong to move in with someone if you're not married. We wanted to move in with each other. We were here. Obviously we felt like we've been married for years. We've been dating. We bought a house together. We got an apartment together. Our anniversary is this month. Oh yeah. Oh my gosh, wait. Oh my gosh. Our six year anniversary is this month. So that's just like another thing. I think we're six, oh our six year is literally in two weeks from now. It's on the 22nd. It's on the 22nd of March. Two weeks from today. So literally two weeks from today. We are literally going to be having our six year anniversary. So like that just shows like I feel like not only was I like didn't rush it. I feel like I could have done it way earlier. Yeah. So I feel like if anything, I waited. I was getting to the point where I'm like when is he gonna do this? Like he knows how badly like we're ready. We said I have to remove the door house and we settle down. Like we need to be ready for that next step. And obviously I let him do it on his time. I didn't force him to rush him. I wanted him to do it when he were ready. And I'm not gonna get that way. Answer all your questions. I disagree. I think I waited honestly rather than like rushed it. Because if I rushed it, I would have done it three years ago. Oh yeah, for sure. Yeah. Oh, this is a controversial one. Let's get juicy. Come on. You might not think this one's juicy, but I think it's juicy. Cats are better than dogs. Whoa, do you see how controversial that one is? See, this is hard because we own two cats, but I already know my answer. Listen. I already know my answer. Okay, I'm just gonna say my answer and then I'll, I'll. I have it right here. I have it right here too. It's the only one not backwards. 50-50. 50-50? You think cats are better than dogs? Okay, it's hard. I guess I would say I'm 50-50. See, the thing is they both have their strengths and their weaknesses. Strengths of cats is they're very independent. They can basically live on their own. They don't eat all their food at once.  Okay? We say something to our cats and they know exactly what we're talking about. Like it's crazy. To prove it, I don't even know where chat is. Snap, snap outside. Outside. Snappy, wanna go outside? Snap, oh, he's at the door. He's literally right there.  That's really mean. Ready? Snappy. Floss. Floss. Example, I feel like I'm a cat person because as of right now, only because we travel a lot, we're very busy, we don't really have time to walk our dog or let the dog out or we're just not home enough to give a dog attention. I feel like a dog is kind of like a full-time job. And I said 50-50 because I don't think either or are better than one another. I feel like they both have their strengths and they both have their weaknesses. It just depends on what you also grew up with, what you love. Like Mariah honestly grew up with dogs. I did. I'm a dog lover. I'm an animal lover. I'm an animal lover.  But that just shows you can also teach cats certain words. So far our cat knows like six words that when we say them, including his name, he knows exactly where to go, what to do. And if I said outside, he goes straight to that door. Even if I'm not standing by the door, I could be in the bathroom. And if I say outside, he will literally go. He's literally over there by the door right now. Men should have periods. Oh my gosh.  Aubrey! Disagree, what? I say agree. Okay, I wouldn't say I would want you to go through it, but I'd rather you go through periods than me because I feel like you guys are more strong-willed. You can handle things sometimes better than women can with their stomachs, okay? I only say that because I would only want you to experience it once so you know my feelings. For the girls out there that want guys to go through periods or whatever. Yeah, okay, I wish I could maybe go through it once to see how it is, but the thing is, I feel like girls go through stuff and guys go through stuff. Whatever the stuff that is, there's a lot of stuff that comes along with being a guy that girls don't experience. That is true. And I'm not saying it's hard to be a guy because it's not, but it's also like, there's a lot of stuff that girls do that guys are never gonna, so it's like, I don't know. We both have things that you're never gonna have to worry about, never gonna have to deal with, but same with girls, I know girls do a lot. So period-wise, yeah, of course I wish I could take the pain away from your period cramps. But hell no, I don't want that every month. That's so much work. Oh my gosh, shout out to all your ladies because I don't know how you do it. It takes a lot of energy. It does take a lot of you. And now that I have a UTI, it's been taking a lot out of me with my freaking medicine instead of being nauseous. That's news too. Woo! Agree or disagree with the thoughts of having kids during Nell's honeymoon. Ooh, honeymoon kids, honeymoon children. Okay, so I'm gonna put my answer up. I have my answer. I really, okay, I have my answer too. Okay, 50-50. Hey!  I already know what it is. We have not waited till marriage and that's just how we've grown up. Listen, there's some people who wait until marriage and people don't. But with us, we use all the protection we can. And I know a lot of people are like, you use protection, oh my God. I don't know, because I'm not ready to have a kid yet. Now, I did say after a wedding, I wanna cut all the protection off. I don't need that anymore. I said on our honeymoon, I wanna like not use protection anymore and if it happens, it happens.  I don't know how we're gonna feel in a year because I know we already have baby fever. 50-50 for me because I don't mind if we do have kids and I don't mind if we don't. Like obviously, like I really feel like I'm not ready to be a dad right now just because like I'm so experienced. No, but it's not even that. I feel like I just like, I haven't like been through the wedding stuff yet and experienced all of that. So if it happens, it happens. But like- I'm not fully ready. We're not rushing anything and we're not gonna be sad if anything does happen. We're just open-minded, you know? And we really don't mind. Obviously, we're gonna be together forever. So whatever happens- We're taking all the precautions now so we don't get pregnant anytime soon. I mean, anything's possible. Do you agree with milk before cereal? Oh my gosh. Oh, but that's not even a question, okay? Okay, I'm just gonna say disagree. If you put your milk in before your cereal- Ew! First of all, when you put your cereal in the milk's gonna splash everywhere. Second of all, you don't know how much milk you're gonna use or need because when you put your cereal in first, you kind of fill your milk up until you start seeing it seep through. Yeah, it's not too much. And then you're like, I'll stop. Yeah. And at the same time, when you pour it into the cereal, the milk doesn't splash. It kind of uses it as a sponge and keeps all the milk from going out the bowl. I've seen so many times people pour milk in the bowl and it goes, whoop! Because it's like, you know, like- Yeah, no. I'm not hating on people if you put milk in, but like, you don't do that. I'm sorry, but like, that's just, I feel like it was not made to be like that. No, I agree. But if you wanna be different, be different.  Judges are free zone. Things are being non-traditional nowadays, so it's okay. All right, this question was from Matilda. Pineapple belongs on pizza. This is a huge one. Yeah, it is. Does pineapple belong, do you agree pineapple belongs on pizza? Agreed. You like pineapple, right? I love pineapple on pizza. If you haven't tried it, don't be a hater until you try it. It's good. It's actually good. I don't think pineapple deserves to not be on pizza. It tastes good, it's warm. Yeah, oh. I don't hate it. It's so good. I love it. And I didn't show you. Nope. You feel pressure to have a lit wedding because of YouTube. Like, an insane, like crazy, wedding. Okay, I actually have an answer. Okay. Ready? Disagree, 100%. I will say this because I feel like, not that I don't care what you guys think because I do, but no matter what, I am listening to what me and Bill want in our wedding and I know you guys will love whatever we choose to do. I'm doing it for me and Bill and what our visions and our dreams are for. That's why I don't feel pressure because I'm gonna love my wedding no matter what. That's my wedding, our wedding. That's special to us, not to anyone else. Me, I said disagree because yeah, I've seen a lot of YouTubers that do crazy, crazy things with their weddings, you know, and they're beautiful and they're awesome. It's not the drama bit.  I might have said I would be in little, like, you know, have that in the back of my head, like, oh, we have to make this super dope. But ever since I've been wedding planning, I haven't even thought about it until now, until you asked this question. I've really not factored in to be competitive with any other wedding that I've seen or to think that I need to do anything more or less because of people having, like, insane weddings. The only thing though that I did think about when it comes to, you know, filming is the videographer. Oh yeah. And we're spending pretty good amount on a videographer because, like, we want the best video and quality possible sound, everything, emotion.  You think our proposal video's good. If you haven't seen our proposal video, make sure to go and watch our proposal video after this. You think that video was good. Our wedding video, just by planning out the videography so far, it's gonna be dream. Oh, it's gonna be so dreamy. Oh my gosh. But yeah. That's the only thing that I've actually, like, thought of. I agree with you, like, I don't feel like, just because someone else wants to go big doesn't mean you have to flip, you have to, too. Matter of fact, I haven't even looked at any other weddings to get inspiration. You've just been planning stuff. Maybe I will. Maybe I should just to see if, like, oh, we should have had that at ours. Yeah. Either way, our wedding is gonna be super dope. You guys are gonna love it. It's gonna be literally like, up until last, like, already the stuff that we have planned, I'm so excited for. It's crazy. It's coming together, too, little by little. We're gonna be sharing more here and there. Yeah. Is Mariah the one that causes the arguments? 90% of the time. Someone asked it. I didn't ask it, okay? I didn't ask. I don't know what you're gonna say. Disagree. What would you say? Oh, no, no, no, I meant, I meant. Did you? I meant 50-50. Oh, okay. 50-50. Listen. 50-50. Calm down. Okay, I want you to answer this first. I want you to answer this first. Okay. Go ahead. All right, so I really didn't mean to put up a grade. So the only reason why I say 50-50 is because me as a person, I am, like, not to toot my own horn. I feel like I'm the most non-problematic. Oh, fine. Then I know. Yes, you are non-problematic. You're the thing. You're the thing.  And I'm not saying that I don't cause problems because I do, so don't think that I'm trying to, like. No, we need to be manipulative right now. Because, like, my goal is to not argue.  It's just to, like, talk it through or something. So with that being said, when some situation does occur, whether it's me or her, I feel like the one, the other 50%, the one propelling the situation 90% of the time could be my other half, 50-50. But I'm not saying that you're really arguing. I agree. I agree with what he's saying, only because I do think he's the water that tries to put the fire out. I'm the one that will fight, because I'm a fighter. That's how I grew up. I mean, don't get me wrong. Sometimes a fire extinguisher can malfunction. Oh, yeah.  Because I feel like sometimes there are situations where I want you to be louder, and I want you to, like, be like, no, that's not okay, but you are more quiet, and it makes me mad, so then it makes me get more mad, and then it becomes a bigger argument.  Yes. Not when it comes to just arguing. Just when it comes to, like, how you do things, how you think. I have the biggest heart ever. If you know me, deep down, know me, I have probably one of the biggest hearts I know. Yeah, you're aggressive in a lovey way, you're aggressive.  I'm not the type of person that keeps that in. I say how it is. She definitely doesn't say good things. I call them. No, I don't say a good thing. That's why I'm the more, like, okay, this is what the hell's up, and he is the one that's like, no, no, no, it's okay. I think I explained that pretty well. You did. You did. I don't think you argued all the time either. I just think, you know. You gotta have a half medium. You can't have two people who argue all the time. That's why I said 50-50. Yeah. I think you're right. I would change my answer 50-50. Okay, so now that it's used, now it's me. Well, technically it was 50-50 till you had it 97 at the time. Anyways. Do you agree on an open relationship? Like, having a three with some. Oh my gosh.  This is going to hurt some people's feelings, isn't it? I disagree. Disagree at a million percent. Because the thing is, if you're going to have an open relationship, you might as well not have a relationship. You might as well just be a bird that can fly wherever it wants, but it's not tied down to one nest. I just feel like every operation that I have come in kind of with or seen, something always happens where the person gets just, I mean, in some situations, okay, I support it, I'm like, whatever. If that makes you happy, that makes you happy. But I've just seen a lot of situations where people will, you know, have a three with some, and then the person will end up like, he kind of steps with that person more than the other person. Does that make sense? You've seen a lot of situations? No, I've just heard a lot of situations. No, trust me, trust me. Just thinking about it, it just seems so super complex. I don't want to see you kissing someone girl. People, like think about it. People's feelings are going to start getting hurt. You're going to be always on edge. You're going to be wondering how they're thinking about you. Are they doing the same thing behind your back? Because like, having an open relationship, I feel like a lot of it, it's easy to lie. And it's easy to get stuck in a situation where you become not faithful to that person. Like, more of the story for me. Okay, and it's not hitting on anyone. No, it's not. If you have an open relationship, I feel like it's kind of like you don't have a relationship at all. Yeah. It's more so just, you just like, hanging out with people. I just would not want to see you kissing and hugging or do any of that with someone else. Like, I would literally cringe and- Yeah. But we don't know the other side of it. We don't know the people that are in an open relationship. Yeah, I don't know their feelings. Because like, you know, we are like, you know, we're like focused on one person and one person only. But like, I don't know, I just feel like having an open relationship, that's just like kind of to me an excuse saying like, you just don't want to be in a relationship because you want to have freedom. Yeah. Which don't be in a relationship then. I don't know. That's just my thing. No, I'm with you on that one. I'm with you on that one. Just know guys, we're not judging anyone who does. 100%. We love every single person. Literally, you do what you want. Don't let anyone tell you no. This is our opinion. This is our life. Yeah. That's why like, we just think how we think. That's why we're getting married. Yeah, exactly. We're about to be husband and wife and I can't wait for that. That's crazy. 11 months. 11 months guys, we're literally coming down. I proposed it was 13 months. Now it's 11 months. Oh my gosh. It's gonna become so fast. If you have not subscribed to our channel yet, make sure to subscribe because I want all of you to be updated and stay tuned for all of the amazing content. And if you guys want to see a part two in this video, make sure you give this video a big thumbs up, comment down below because we will love to do another one of these in like the next couple of weeks because I feel like this is really fun. I feel like we didn't get to answer all the questions because like you can only answer so much. In our next video, make sure to be following us on Instagram because we are gonna be using your questions to create the controversy. The team. The agree, the disagrees, the 50-50s in our next video. And we want you to be part of it. So make sure to do that. We appreciate you guys watching this video and we will see you in the next one. But until then, peace. Love you guys.