Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

twitter.com

Post reply on HN
Print view View original

31–40 of 43 posts

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#31

Post by shmoe »

adrianN wrote: post #18
nexuist wrote: post #17

Earlier quoted context omitted.

I also believe this is not an issue right now, but I'll throw this out to ponder: Since supercharging is paid and tied to the VIN, that implies that there is some kind of data transfer occurring between the vehicle and the charging station, right? It's not just a dumb terminal connection. Given that this is the case, could a theoretical exploit use that data connection to gain access to the vehicle and e.g. unlock th…

One would hope that the part of the car that communicates with the charger and the part that controls the doors are separate.

Most certainly.. the doors are BLE or an rfid card on any current Model 3/Y.

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#32

Post by shmoe »

somedude895 wrote: post #15
blamazon wrote: post #8

Earlier quoted context omitted.

On my 2017 model x the charging port is locked shut when the car is locked. I get a strange amount of vitriol from anti-EV folks where I live, I could imagine somebody putting a metaphorical potato in the metaphorical tailpipe. Although that type of person is more likely to use a screwdriver than a replay attack.

Is it really locked? I don't know the Model X well enough, but on my 2018 Model S the charging port is underneath the reflective part next to the brake light, which you can open by pressing down on it. I only found out I didn't have to use my key to open it a couple months ago.

Don't forget being near the car with your key is enough to be "unlocked". Ditch your fob inside and try it.

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#33

Post by shmoe »

LinuxBender wrote: post #26

I do not know much about EV's. Can you steal power from the car by only having access to the charge port or can you interface with the cars computer through this port? I know that some people power their homes with their car but does that require doing something with the cars computer or does the car have default and secure settings one can or should change?

Teslas dont have any V2G or V2H ability just yet, so not really. You could gum it up with something if you wanted to be a jerk, but couldn't you do the same to a lot of gas tanks that aren't locked?

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#34

Post by widdakay »

TheDong wrote: post #3

This seems to firmly be in the realm of "eh, working as intended, who cares". The charging port cover, as far as I know, isn't a security mechanism, and it opening is just a matter of user convenience. Having an easy protocol to open it means that a third-party charger can open it automatically to be inserted more easily, so that seems fine. Even if they did require some sort of signed message from the charger, since…

Furthermore, if I press the button when near two Teslas, both charge ports open up, so the ability for the person to replay the signal yielded a "duh" to me.

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#35

Post by LinuxBender »

shmoe wrote: post #33
LinuxBender wrote: post #26

I do not know much about EV's. Can you steal power from the car by only having access to the charge port or can you interface with the cars computer through this port? I know that some people power their homes with their car but does that require doing something with the cars computer or does the car have default and secure settings one can or should change?

Teslas dont have any V2G or V2H ability just yet, so not really. You could gum it up with something if you wanted to be a jerk, but couldn't you do the same to a lot of gas tanks that aren't locked?

couldn't you do the same to a lot of gas tanks that aren't locked?

Absolutely, that's why I use a locking gas cap. They aren't perfect but they are a PITA to take off if the key doesn't work. I've had to remove one without the key.

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#36

Post by natch »

gambiting wrote: post #23
natch wrote: post #22

Earlier quoted context omitted.

Off topic, I'm curious, as a Volvo owner, do you think Volvo is Swedish owned?

I think it's a Swedish car. Even though my particular one was actually made in China. And I know what you're hinting at but I don't actually care. Just like a Land Rover is a British car even though it's owned by an Indian corporation.

I bought a Volvo a long time back and it turned out it was a Ford Focus with a Volvo skin. My mistake. Never again. Not that I have anything against Ford but the quality was atrocious — things just falling apart for no reason at all other than they must have not been made properly. I babied the car and the things that went wrong ($1000 - $2000 repairs) were amazing… like all the parts in the mechanism for moving the moon roof, which I pretty much never opened, spontaneously started sliding around in the rooftop one day. I heard they are now Chinese owned, although it seems buyers think they are still Swedish. Thanks for the reply.

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#38

Post by rosndo »

nexuist wrote: post #17
TheDong wrote: post #3

This seems to firmly be in the realm of "eh, working as intended, who cares". The charging port cover, as far as I know, isn't a security mechanism, and it opening is just a matter of user convenience. Having an easy protocol to open it means that a third-party charger can open it automatically to be inserted more easily, so that seems fine. Even if they did require some sort of signed message from the charger, since…

I also believe this is not an issue right now, but I'll throw this out to ponder: Since supercharging is paid and tied to the VIN, that implies that there is some kind of data transfer occurring between the vehicle and the charging station, right? It's not just a dumb terminal connection. Given that this is the case, could a theoretical exploit use that data connection to gain access to the vehicle and e.g. unlock th…

A theoretical exploit can always hack anything at any time anywhere.

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#39

Post by kiwidrew »

LinuxBender wrote: post #26

I do not know much about EV's. Can you steal power from the car by only having access to the charge port or can you interface with the cars computer through this port? I know that some people power their homes with their car but does that require doing something with the cars computer or does the car have default and secure settings one can or should change?

On the Nissan Leaf, the CHAdeMO fast charging port connector exposes (one of) the car's CAN busses (a little in-car network). It's unauthenticated and has commands for charging and discharging the battery. The car doesn't need to be turned on, the vehicle computer wakes up any time that a charging cable is connected. The only security is a small door that covers the charging port, but I'm certain it could be jimmied open with a bit of patience.

So yeah, it's absolutely possible to just walk up to a random Leaf on the street and extract DC power from it (e.g. to charge another EV or power an AC inverter) but you'd need to build your own cable and controller, and also 500VDC at 100A is extremely lethal so it's a terrible idea....

Re: Tesla's charging ports use a standard msg to open on 315MHz and can be replayed

#40

Post by speedgoose »

roeles wrote: post #27

I wonder how well protected the charging circuits are against damage from malicious chargers. If it is at all possible to damage the car, then I can image this turns out to be a problem.

What’s the threat model? It’s not much simpler to break a window and put the car on fire?
Post reply on HN