Between having a very low risk of someone opening the charging port flap for a few seconds and having to pair a charging cable with the expensive “Tesla button”, I take the risk.
Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
11–20 of 43 posts
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#12Flipper Zero made this popular again it seems. Its known for a while.
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#13All I have seen on here is cynical thinking, whether it's merited or not; so I will add something novel to the discussion.
This could be a cool feature! What if the Supercharger stations broadcast that frequency as you pull up to save you a step! ...or... In the "Fully Automated Future!"© The robotic arm that connects your Tesla to the charger emits that signal to access your charging port!
I drive an ICE car that does not have a lock on the fuel port. The gas cap doesn't have a lock either.
This Tesla feature is more secure then my car. And fuel can be siphoned out of my car.
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#14I’m having a hard time coming up with a reason why there needs to be any replay protection here. That port is supposed to open without unlocking the car. You can approach a locked Tesla and press the button on a charging connector and it’ll open. The whole thing is unauthenticated by design.
Yeah. The charging port on my Volvo never locks, and I see that as a good thing - it means I can get out of the car, lock it, then go around and plug the charging cable in. Don't really see any issue with it.
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#15I’m having a hard time coming up with a reason why there needs to be any replay protection here. That port is supposed to open without unlocking the car. You can approach a locked Tesla and press the button on a charging connector and it’ll open. The whole thing is unauthenticated by design.
On my 2017 model x the charging port is locked shut when the car is locked. I get a strange amount of vitriol from anti-EV folks where I live, I could imagine somebody putting a metaphorical potato in the metaphorical tailpipe. Although that type of person is more likely to use a screwdriver than a replay attack.
Is it really locked? I don't know the Model X well enough, but on my 2018 Model S the charging port is underneath the reflective part next to the brake light, which you can open by pressing down on it. I only found out I didn't have to use my key to open it a couple months ago.
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#16This behaviour is pretty old, I think Gael Musquet told me about this in 2018: https://nitter.net/ratzillas/status/958696765275942912
« Analysis of the radio opening of the charging hatch on @Tesla with #URH and #rtl433. Results: frames are the same for all superchargers/cars. A simple 433mhz module and a microcontroller allow you to open the hatch remotely by replaying the sequence! »
And it has been known since 2013 on the tesla forums: https://teslamotorsclub.com/tmc/threads/open-chargeport.2100...
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#17This seems to firmly be in the realm of "eh, working as intended, who cares". The charging port cover, as far as I know, isn't a security mechanism, and it opening is just a matter of user convenience. Having an easy protocol to open it means that a third-party charger can open it automatically to be inserted more easily, so that seems fine. Even if they did require some sort of signed message from the charger, since…
I also believe this is not an issue right now, but I'll throw this out to ponder:
Since supercharging is paid and tied to the VIN, that implies that there is some kind of data transfer occurring between the vehicle and the charging station, right? It's not just a dumb terminal connection.
Given that this is the case, could a theoretical exploit use that data connection to gain access to the vehicle and e.g. unlock the doors? Since any common criminal can open the charging port with this exploit, they could also plug in a fake charger to weaponize the exploit and drive away with a free car.
Yeah, I know, sounds pretty ridiculous. But these are expensive cars and it might be reality soon enough similar to how common thieves can buy replay attack devices on the black market now.
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#18This seems to firmly be in the realm of "eh, working as intended, who cares". The charging port cover, as far as I know, isn't a security mechanism, and it opening is just a matter of user convenience. Having an easy protocol to open it means that a third-party charger can open it automatically to be inserted more easily, so that seems fine. Even if they did require some sort of signed message from the charger, since…
I also believe this is not an issue right now, but I'll throw this out to ponder: Since supercharging is paid and tied to the VIN, that implies that there is some kind of data transfer occurring between the vehicle and the charging station, right? It's not just a dumb terminal connection. Given that this is the case, could a theoretical exploit use that data connection to gain access to the vehicle and e.g. unlock th…
One would hope that the part of the car that communicates with the charger and the part that controls the doors are separate.
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#19All I have seen on here is cynical thinking, whether it's merited or not; so I will add something novel to the discussion. This could be a cool feature! What if the Supercharger stations broadcast that frequency as you pull up to save you a step! ...or... In the "Fully Automated Future!"© The robotic arm that connects your Tesla to the charger emits that signal to access your charging port! I drive an ICE car that do…
The robotic arm that connects your Tesla to the charger
Tesla demoed that in 2015, but didn't make it into a product.[1] Apparently too many people thought it was "creepy".
(That's a good way to do the job. Snake arm robots are quite simple. The tube just contains some pull cables running through disks with holes.[2] All the motors are in the base. So you can build one of these with a protected base and an easily replaced arm tube. The usual problem with snake robots is that the cables wear out. But that's in painting applications, where they're in constant motion all day. A charging robot moves, slowly, for maybe one minute per hour. They're not very repeatable, which is fine in this application. The car won't be in the same place every time anyway. There's a TV camera in the end to find the socket. It's too bad that didn't ship as a product.)
Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed
#20This seems to firmly be in the realm of "eh, working as intended, who cares". The charging port cover, as far as I know, isn't a security mechanism, and it opening is just a matter of user convenience. Having an easy protocol to open it means that a third-party charger can open it automatically to be inserted more easily, so that seems fine. Even if they did require some sort of signed message from the charger, since…
But it is Tesla, so people has to make a drama about it
Recently I was talking to someone about my new Model 3. They had heard all about the body panels not lining up. But when I asked him if he had ever heard about the Subaru brake light recall or the Toyota airbag shrapnel, he became concerned because he drives a Toyota.
For some reason, all minor Tesla recalls become public scandals yet serious safety-related recalls of other automakers are obscure.