Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesla Model S Ethernet Network Explored

dragtimes.com

Post reply on HN
Print view View original

61–70 of 112 posts

Re: Tesla Model S Ethernet Network Explored

#61

Post by Maxious »

eridius wrote: post #19
driverdan wrote: post #4

“Tesla USA engineers have seen a tentative of hacking on my car.”, “can be related to industrial espionage and advised me to stop investigation, to not void the warranty”. So long as you don't cause any damage they can't void your warranty in the US thanks to the Magnuson–Moss Warranty Act.

Poking around an unknown device's network and sending arbitrary commands to see how it responds could certainly very well damage something.

On page 53 of the "Adventures in Automotive Network and Control Units" paper there's a photo of what happened to the researchers garage after a command to run diagnostics on the brakes left the vehicle unable to stop even at slow speeds http://illmatics.com/car_hacking.pdf

Re: Tesla Model S Ethernet Network Explored

#62

Post by el_benhameen »

anologwintermut wrote: post #51
AceJohnny2 wrote: post #41

I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems. Automotive systems communicate over a CAN [1] bus, not ethernet. In fact, this bus is usually physically separated between drive-critical bus (which controls things like ABS) and "comfort" bus (such as electric window controls, central door locks, wheel-mounted audio controls). Ethernet has none of…

Sadly, the segregation between CAN buses is not nearly as good as you would think. ONSTAR, for example, sits on the drive critical bus (and is exploitable). Of course, this is not on a Tesla, but still. http://www.autosec.org/pubs/cars-usenixsec2011.pdf

I'm probably missing something here, but wouldn't it make sense for ONSTAR to sit on the drive critical bus? If it's able to monitor collision data and (in newer models) slow down a stolen car, it'd need access to drive-control systems.

Re: Tesla Model S Ethernet Network Explored

#63

Post by sounds »

mschuster91 wrote: post #38
eik3_de wrote: post #30

Earlier quoted context omitted.

but only if their binary is linked against a gpl library..?

Nope, it is enough to distribute any binary made with GPL source code to have an obligation to publish the code. As soon as you use GPL code, no matter if you modify it or not, you have to re-distribute the source code you used.

"The source code you used" which you obtained from GPL sources.

You do not have to distribute proprietary source code which has not been incorporated into the GPL code (the definition of this varies depending on whether the GPL code is GPL, LGPL, etc.)

Re: Tesla Model S Ethernet Network Explored

#64

Post by sebastianavina »

jnbiche wrote: post #23
driverdan wrote: post #4

“Tesla USA engineers have seen a tentative of hacking on my car.”, “can be related to industrial espionage and advised me to stop investigation, to not void the warranty”. So long as you don't cause any damage they can't void your warranty in the US thanks to the Magnuson–Moss Warranty Act.

And that's a mighty hacker-unfriendly stance to take for a company whose client base is made up of a disproportionately large number of engineers and computer scientists, many of whom will doubtless be curious as to the inner workings of their car computer systems. I mean, could you imagine if a car manufacturer took this attitude toward car owners who were exploring the car's transmission, which is clearly just as c…

Maybe all the source code of the media system is written in Python, and everybody can see / modify the code..

Re: Tesla Model S Ethernet Network Explored

#65

Post by mdorazio »

AceJohnny2 wrote: post #41

I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems. Automotive systems communicate over a CAN [1] bus, not ethernet. In fact, this bus is usually physically separated between drive-critical bus (which controls things like ABS) and "comfort" bus (such as electric window controls, central door locks, wheel-mounted audio controls). Ethernet has none of…

Thank you for pointing this out. A few additional notes on the way most modern car electronics work:

1) The entertainment system generally has read-only access to the CAN bus via an intermediary DCU. Even if you were able to "jailbreak" it, you wouldn't be able to modify the CAN.

2) The control unit(s) that actually have the ability to modify things like brakes, maximum speed settings, etc. are ECUs (http://en.wikipedia.org/wiki/Electronic_control_unit) and are entirely separate from the entertainment system.

3) Updates to vehicle-critical systems generally never even go through the entertainment system. They are sent over the air to the car's receiver (usually a kind of DCU), and are processed outside the purview of the entertainment system. The only thing the entertainment system can do is schedule the download and read the progress of the update.

It's interesting to see that Ethernet is used to connect the infotainment displays, but this isn't really a security concern as far as I can see. It just means we'll probably see some mods for the displays in the future, like turning off the YouTube lockout or enabling different data displays.

Re: Tesla Model S Ethernet Network Explored

#66

Post by PinguTS »

mikepurvis wrote: post #55
Dwolb wrote: post #47

Earlier quoted context omitted.

Just a note, automotive Ethernet PHYs exist [1] and there is some interest in real-time Ethernet applications (piggy-backing on an original audio use case, AVB) [2]. [1] http://www.broadcom.com/products/Physical-Layer/BroadR-Reach... [2] http://www.eetimes.com/document.asp?doc_id=1315425

There's also EtherCAT, which has been around for a while and has realtime and safety guarantees.

lol, Ethercat, lol

Yeah, it looks like ethernet, but it isn't. It is not used in cars. Currently, I don't know if it will be used in cars. Presumably not. Ethercat is used for hardware in the loop simulation.

Re: Tesla Model S Ethernet Network Explored

#67

Post by obituary_latte »

el_benhameen wrote: post #62
anologwintermut wrote: post #51

Earlier quoted context omitted.

Sadly, the segregation between CAN buses is not nearly as good as you would think. ONSTAR, for example, sits on the drive critical bus (and is exploitable). Of course, this is not on a Tesla, but still. http://www.autosec.org/pubs/cars-usenixsec2011.pdf

I'm probably missing something here, but wouldn't it make sense for ONSTAR to sit on the drive critical bus? If it's able to monitor collision data and (in newer models) slow down a stolen car, it'd need access to drive-control systems.

I'm unsure whether it makes sense in the context of safety. However, in the context of being able to sell the product as having those features - makes perfect sense.

Re: Tesla Model S Ethernet Network Explored

#68

Post by PinguTS »

Dwolb wrote: post #47
AceJohnny2 wrote: post #41

I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems. Automotive systems communicate over a CAN [1] bus, not ethernet. In fact, this bus is usually physically separated between drive-critical bus (which controls things like ABS) and "comfort" bus (such as electric window controls, central door locks, wheel-mounted audio controls). Ethernet has none of…

Just a note, automotive Ethernet PHYs exist [1] and there is some interest in real-time Ethernet applications (piggy-backing on an original audio use case, AVB) [2]. [1] http://www.broadcom.com/products/Physical-Layer/BroadR-Reach... [2] http://www.eetimes.com/document.asp?doc_id=1315425

Yeah, BroadR-Reach is currently used by BMW only. There will be more used cases, but I can't talk public about for obvious reasons. But then, don't expect to have TCP/IP available, like this article suggest.

Re: Tesla Model S Ethernet Network Explored

#69

Post by munin »

nacs wrote: post #53
evv wrote: post #48

Earlier quoted context omitted.

Seriously? You're illustrating the point here. On low tech cars, an attacker has to hack the cars one-at-a-time. They could endanger one car load of people with each "job". With high-tech cars, an attacker could hack every car of the same model. With thousands of Teslas on the road, I think it merits a higher concern than somebody with side cutters. I thought it was obvious. Next time I'll let it go unsaid..

It's a wired-ethernet network not Wifi. The attacker would still need physical access like the low-tech attacker to network and update software on the Tesla. Also, the brake line could be cut in seconds whereas 'jailbreaking' and then flashing the drive control software would take ages in comparison.

yeah but the state police can examine a crash after the fact to determine a brake line was cut.

even if the software survives a high-speed crash, it's possible for the surreptitiously placed modification to erase itself as its final act. additionally, the surreptitiously placed modification can wait for weeks or months, giving the attacker time to build a cover story or misdirect or accomplish any number of other goals.

Re: Tesla Model S Ethernet Network Explored

#70

Post by [deleted] »

mitchellh wrote: post #3

The cool things: Tesla is running Linux (!) and standard technologies/protocols such as SSH, NFS, X11, HTTP, etc. to do things in the car. That is cool, and probably highly efficient since developer test labs can probably just be basic Ubuntu-like virtual machines. The sketchy things: Jailbreaking a car seems pretty dangerous, especially since as far as I'm aware, the electronic systems control things including the b…

[deleted]
Post reply on HN