Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesla PowerWall 2 Hack

github.com

Post reply on HN
Print view View original

141–150 of 175 posts

Re: Tesla PowerWall 2 Hack

#141

Post by aguyfromnb »

marvin wrote: post #114
ncmncm wrote: post #101

Earlier quoted context omitted.

This is amazing. It is all completely plausible, and clearly includes only the most easily explained horrors, with anything that would require explanation just omitted. It is worse than I would have been able to invent.

IMHO, these stories aren’t unexpected from a tech company that grows 80% year over year, developing and expanding as fast as technology and market forces allow. Yes, there are mistakes and unfortunate incidents in the organization of people and tech priorities here, but this is inevitable in an engineering org that moves this fast. You really need to measure this up against Tesla’s achievements: Growing high double d…

>For the sake of enlightening discussion, could you please express your disagreement in words rather than the downvote button?

I'll give it a try: maybe it's because someone made an off-hand comment about Tesla shipping a default password, and you chimed in with an apologetic post that reads a lot like astro-turfing?

>did this with almost zero paid marketing

Traditional marketing. Tesla spends millions on marketing annually, it's right there in their financials. Just recently a pile of pro-Tesla Twitter bot accounts were banned. Did you know that Tesla is paying people to post messages on social media?

Re: Tesla PowerWall 2 Hack

#142

Post by sneak »

HereBeBeasties wrote: post #118
sneak wrote: post #111

Earlier quoted context omitted.

The vendor’s existence and actions are irrelevant to whether or not it’s okay to publish your research at any time. It is never irresponsible to disclose one’s research in public, in full. Vendors don’t factor in to it at all .

Their customers do, though, and that's the whole point. Without giving people a short, reasonable time to patch, you're part of the problem, not part of the solution. For what it's worth, you are also coming across as something of a zealot, rather than a reasonable person who sees the world in shades of grey.

The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not.

The side effect that it is available to attackers is also irrelevant to the determination of whether or not it’s irresponsible; it also becomes available to the vendor who shipped it.

This notion of “you have to give the vendor time to patch xor you are irresponsible” is itself bogus. The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is.

Re: Tesla PowerWall 2 Hack

#143

Post by jacobush »

reitzensteinm wrote: post #97
londons_explore wrote: post #56

The only bug here is the default password. After authentication, the fact you can make it charge or dump power into the grid is by design. If I wanted the grid to suffer, I can do this by plugging in and unplugging a multi-kilowatt heater every few milliseconds too. Residential properties have a fuse (usually 60-100Amps), and anything you can do without blowing that fuse won't damage the grid.

The fast switching ability isn't a bug by itself, but it makes the insecure authentication much worse. Shitty IOT auth does not mix with power electronics. Whether Tesla is worse than other providers in this space is another question, and may well have a depressing answer.

The fast switching is still a failure of defence in depth.

It could be internally rate limited to some value (which I don't know), and also with some random backoff value so Powerwalls could not be synchronised.

Re: Tesla PowerWall 2 Hack

#144

Post by audunw »

madaxe_again wrote: post #128
jacquesm wrote: post #126

Earlier quoted context omitted.

> and anything you can do without blowing that fuse won't damage the grid That's what you'd think. But I have actually done damage to the grid and had that fuse still in one piece. I accidentally connected the -HV line of a neon light installation to ground. After I could see again I realized the power had gone out. I called my boss (landline still worked) who lived more than a kilometer away from the workshop and th…

This is exactly what RCDs are for - with a huge earth leak like that (and therefore L/N imbalance) it would have tripped within milliseconds, before cooking the grid. I am surprised by how infrequently they seem to be used outside of the U.K. - I’ve just rewired my house in Portugal as it was completely unearthed, and just had fuses, no RCDs.

It's required on all new construction in Norway for a decade or so as well. Very common for renovations as well.

Norway also just switched to smart meters, which can detect ground problems as well, and supposedly a lot of issues has already been prevented by these being automatically reported. I suppose this is something which is more likely to spread to other countries, as it's not just a safety thing, but also an upgrade that makes your life more convenient, and saves the utilities money in the long term.

Re: Tesla PowerWall 2 Hack

#145

Post by [deleted] »

aguyfromnb wrote: post #141
marvin wrote: post #114

Earlier quoted context omitted.

IMHO, these stories aren’t unexpected from a tech company that grows 80% year over year, developing and expanding as fast as technology and market forces allow. Yes, there are mistakes and unfortunate incidents in the organization of people and tech priorities here, but this is inevitable in an engineering org that moves this fast. You really need to measure this up against Tesla’s achievements: Growing high double d…

> For the sake of enlightening discussion, could you please express your disagreement in words rather than the downvote button? I'll give it a try: maybe it's because someone made an off-hand comment about Tesla shipping a default password, and you chimed in with an apologetic post that reads a lot like astro-turfing? > did this with almost zero paid marketing Traditional marketing. Tesla spends millions on marketing…

[deleted]

Re: Tesla PowerWall 2 Hack

#146

Post by marvin »

aguyfromnb wrote: post #141
marvin wrote: post #114

Earlier quoted context omitted.

IMHO, these stories aren’t unexpected from a tech company that grows 80% year over year, developing and expanding as fast as technology and market forces allow. Yes, there are mistakes and unfortunate incidents in the organization of people and tech priorities here, but this is inevitable in an engineering org that moves this fast. You really need to measure this up against Tesla’s achievements: Growing high double d…

> For the sake of enlightening discussion, could you please express your disagreement in words rather than the downvote button? I'll give it a try: maybe it's because someone made an off-hand comment about Tesla shipping a default password, and you chimed in with an apologetic post that reads a lot like astro-turfing? > did this with almost zero paid marketing Traditional marketing. Tesla spends millions on marketing…

I am not affiliated with Tesla or paid by them in any way, if you're implying that. Was also not making apologies for shipping devices with guessable passwords, that's obviously a serious screwup that needs to be fixed - ideally at a level of changing the engineering culture if that's what it takes. But the rest of this thread treats that subject in depth, and I wouldn't contribute anything material to that discussion beyond piling on, which is a bad use of time and brain power. Thought I made it quite clear in my comment that I was specifically adressing the discussion of sub-par software engineering practices, and how this is a very common consequence of extreme growth.

I know Tesla has a marketing budget and marketing people, that's obvious enough, so traditional marketing was indeed what I meant. Maybe I could have made that more clear.

Wasn't aware that they're paying people to astroturf though; first I hear of this. Do you have proof of it?

Re: Tesla PowerWall 2 Hack

#147

Post by nexuist »

unnouinceput wrote: post #124

"The PW can store up to 13.5kW of electric power..." No, you store energy, not electric power, and energy is Wh, that's why you have your phone battery with 5V and 8000 mAh as units and not 8A. "How does the grid feel about me oscilating this and who will die first, the PW or the sub-station?" Definitely the PW. Sub-stations are made to withstand thousand of households switching all at once their light-bulbs at eveni…

If you were to try this and somehow cause damage to the sub station, would you be held liable?

Actually, this brings an interesting question with IoT - if devices damage or otherwise exploit your utility company’s equipment, is it their fault of yours? Presumably doing anything bad is against your utility’s ToS, but if you didn’t do it knowingly...

Re: Tesla PowerWall 2 Hack

#148

Post by tenpies »

marvin wrote: post #114
ncmncm wrote: post #101

Earlier quoted context omitted.

This is amazing. It is all completely plausible, and clearly includes only the most easily explained horrors, with anything that would require explanation just omitted. It is worse than I would have been able to invent.

IMHO, these stories aren’t unexpected from a tech company that grows 80% year over year, developing and expanding as fast as technology and market forces allow. Yes, there are mistakes and unfortunate incidents in the organization of people and tech priorities here, but this is inevitable in an engineering org that moves this fast. You really need to measure this up against Tesla’s achievements: Growing high double d…

I think the problem is that the software model is being used in other industries. Not just in production (e.g. Tesla "move fast and break things" on things that are life/death, or merely very expensive) but also in valuation: Tesla, WeWork, and a ton of others are/were valued as technology companies even if they are clearly not.

When this happen you start getting comically bad results (see: all the summon feature failures on Twitter) and catastrophic valuation corrections (see: almost all the recent "technology" IPOs).

The whole VC market seems to be built on this built-in assumption that everything will be able to scale and have the margin of software companies, even when it is obvious that it is impossible. I am not sure why there is such a gap between reality and VC/investors in general, but it's probably going to seem obvious in retrospect.

Re: Tesla PowerWall 2 Hack

#149

Post by mbreese »

nexuist wrote: post #147
unnouinceput wrote: post #124

"The PW can store up to 13.5kW of electric power..." No, you store energy, not electric power, and energy is Wh, that's why you have your phone battery with 5V and 8000 mAh as units and not 8A. "How does the grid feel about me oscilating this and who will die first, the PW or the sub-station?" Definitely the PW. Sub-stations are made to withstand thousand of households switching all at once their light-bulbs at eveni…

If you were to try this and somehow cause damage to the sub station, would you be held liable? Actually, this brings an interesting question with IoT - if devices damage or otherwise exploit your utility company’s equipment, is it their fault of yours? Presumably doing anything bad is against your utility’s ToS, but if you didn’t do it knowingly...

I would imagine that unless you were a licensed electrician, you would be liable.

Re: Tesla PowerWall 2 Hack

#150

Post by ericpauley »

sorenjan wrote: post #90
nemosaltat wrote: post #6

Can’t believe Tesla would ship something with anything resembling a default password. At first glance, I assumed this would be a clear violation of the requirements of CA SB-327 (goes into effect Jan 1). Reread the bill, and it actually says: “The preprogrammed password is unique to each device manufactured.” If the default is based on the serial number, I guess it’s “unique” under the letter, but certainly not the s…

I guess you haven't seen this then. https://www.reddit.com/r/EnoughMuskSpam/comments/99sbwa/form...

> ssh’d to as many cars as possible

Wow.

Post reply on HN