Let the hacking begin... (Model S parts on the bench)

[Feathermerchan]

I do power supplies. Does anyone need a more powerful 12V supply?

 

[thenaimis]

Seriously, why? I find it so frustrating that information regarding Model S onwards is kept so private. Tesla is working so hard to keep their 'secrets', they really don't need us to help them

There are two primary reasons:

1. Because well-known vulnerabilities are going to get plugged, and those with access want to keep it.
2. Because some of the people with this technical information are using it to make and sell products and they don't want to share the information when it could end up cutting into their profits.

 

[demundus]

Why the secrecy? The last few posts sound like an episode of Penn and Teller fool us.

Seriously, why? I find it so frustrating that information regarding Model S onwards is kept so private. Tesla is working so hard to keep their 'secrets', they really don't need us to help them. People working on opening up the roadster were so much more open to sharing (and still are, perhaps even more so now than before).

Exploits, I understand (not wanting the mothership to know); but let's face it, with the bug bounty program they know anyway. Security and safety issues, fine; we don't want to make it easy for the bad guys. But CAN bus messages, decodes, instructionals, howtos, firmware access, etc?

These are our vehicles. We purchased them, we own them, and we should have the right to do with them whatever we want. The sharing of information is key to that movement, and quite frankly, FUN. I think that even Elon would agree with that.

Not even just the USA and Canada buddies... If any of our unsupported euro/african/asian/islander friends posted how they rooted and support a tesla without corporate's help, it would royally screw future generations of owners. They aren't going to leave those holes open on supported cars for a future salvage or unsupported shipment overseas. Secrecy required, sadly.

 

[kdday]

And because Tesla is known as being retaliatory against those that hack their cars (blacklisting, warranty voids, etc).

 

[KArnold]

Wouldn't officially participating in the bug bounty program pretty much be a CYA and prevent retaliation? Seems like that is exactly what Tesla wants peeps to do. No?

 

[markwj]

Because well-known vulnerabilities are going to get plugged, and those with access want to keep it.

I did specifically exclude exploits, security and safety issues. Those I understand have sensitivity, and retaliatory issues, to some extent. That said, I've participated in the Tesla bug bounty program, and been hacking in the open on Teslas for 8 years now - with nothing but excellent support from Tesla.

My comments are primarily about things like those I listed: CAN bus messages, decodes, instructionals, howtos, firmware access, etc.

Because some of the people with this technical information are using it to make and sell products and they don't want to share the information when it could end up cutting into their profits.

I really hope not, but suspect that you may be right.

Wouldn't officially participating in the bug bounty program pretty much be a CYA and prevent retaliation? Seems like that is exactly what Tesla wants peeps to do. No?

Yes, that is the intent of the program. They specifically authorise us to 'go for it', in writing, and with their blessing. They even say they will try to get you back to a working product, should you screw things up - but obviously not under warranty. Details are here:

Tesla’s bug bounty program | Bugcrowd

Of course, individual mileage varies...

 

[rdrcrmatt]

Why the secrecy? The last few posts sound like an episode of Penn and Teller fool us.

Seriously, why? I find it so frustrating that information regarding Model S onwards is kept so private. Tesla is working so hard to keep their 'secrets', they really don't need us to help them. People working on opening up the roadster were so much more open to sharing (and still are, perhaps even more so now than before).

Exploits, I understand (not wanting the mothership to know); but let's face it, with the bug bounty program they know anyway. Security and safety issues, fine; we don't want to make it easy for the bad guys. But CAN bus messages, decodes, instructionals, howtos, firmware access, etc?

These are our vehicles. We purchased them, we own them, and we should have the right to do with them whatever we want. The sharing of information is key to that movement, and quite frankly, FUN. I think that even Elon would agree with that.

I completely agree. I'd really like to start exploring the car more.

 

[robby]

I did specifically exclude exploits, security and safety issues. Those I understand have sensitivity, and retaliatory issues, to some extent. That said, I've participated in the Tesla bug bounty program, and been hacking in the open on Teslas for 8 years now - with nothing but excellent support from Tesla.

My comments are primarily about things like those I listed: CAN bus messages, decodes, instructionals, howtos, firmware access, etc

I agree wholeheartedly. There is way more secrecy and elitism in the Tesla tinkering community than can be explained by fear of an exploit being patched. I started Unofficial Tesla Service Manual for this very reason -- to show that DIY Tesla maintenance really is possible, and that you don't need hacker or security research credentials to do it. I think you've motivated me to add more material to that site in the coming weeks, and I'd love it if anybody else who feels similarly would contribute.

 

[jaguar36]

There are two primary reasons:

1. Because well-known vulnerabilities are going to get plugged, and those with access want to keep it.
2. Because some of the people with this technical information are using it to make and sell products and they don't want to share the information when it could end up cutting into their profits.

This is exactly what's going on. If you look at the folks (like Wk) who used to post a lot of in depth technical information, they've all got business's now that are selling things that are based on this information so its in their best interest to keep that stuff as close to the chest as possible.

I think its also underestimated just how much effort Tesla is putting in to make it difficult for 3rd parties to do repairs.

 

[rdrcrmatt]

I agree wholeheartedly. There is way more secrecy and elitism in the Tesla tinkering community than can be explained by fear of an exploit being patched. I started Unofficial Tesla Service Manual for this very reason -- to show that DIY Tesla maintenance really is possible, and that you don't need hacker or security research credentials to do it. I think you've motivated me to add more material to that site in the coming weeks, and I'd love it if anybody else who feels similarly would contribute.

You're my new favorite community member! I wrote up a few things a few years ago but never ended up sharing. I'll start contributing.

 

[AWDtsla]

I agree wholeheartedly. There is way more secrecy and elitism in the Tesla tinkering community than can be explained by fear of an exploit being patched. I started Unofficial Tesla Service Manual for this very reason -- to show that DIY Tesla maintenance really is possible, and that you don't need hacker or security research credentials to do it. I think you've motivated me to add more material to that site in the coming weeks, and I'd love it if anybody else who feels similarly would contribute.

Wow. Maybe my AP won't fail on sight the first snow flake now! This should have been a PSA for all cold weather AP owners.

 

[apacheguy]

Does it not fetch them over SSL?

Firmware patch files are fetched over HTTP (unencrypted)

There are two primary reasons:

1. Because well-known vulnerabilities are going to get plugged, and those with access want to keep it.
2. Because some of the people with this technical information are using it to make and sell products and they don't want to share the information when it could end up cutting into their profits.

Granted, but there are several vulnerabilities that have already been patched and nobody cares to share even these exploits. Not sure how that is justified.

 

[Restrected]

i could use some help with extracting a bin from an updated telsa and dumping it in an unsupported tesla (rooted). if anyone can help with instructions please contact me. i have methods of unlocking eth port on both cars. im stuck at that part. i am unable to match offline and online keys and it fails installs. i know its me doing something wrong, but if you can help me figure this out and what i am doing wrong, please pm me.

nothing is for free on this earth. even the air we breathe.

 

[Paritosh Patel]

It looks like a lot of fun.

While you are hacking did you come across how to set the bit (flag) that the bio-filter is installed? I did not get my car with the bio-filter, but I am willing to add one...

 

[tedsk]

Absence of demonstration is keeping me from believing you. Although you're in a country where Tesla barely supports owners, you might have a clever way...

It is indeed possible without getting root access to the CID. IC is wide open (kinda). Still IC has exactly the same firmware as the CID does. So - get into IC, dump it there, copy to your PC. Easy. Problem is - technically it is rooting. Despite being easy to get into IC you still need root access there to dump firmware. So statement still stands - rooting is needed, unless there is other way I have missed here.

 

[nemSoma]

It is indeed possible without getting root access to the CID. IC is wide open (kinda). Still IC has exactly the same firmware as the CID does. So - get into IC, dump it there, copy to your PC. Easy. Problem is - technically it is rooting. Despite being easy to get into IC you still need root access there to dump firmware. So statement still stands - rooting is needed, unless there is other way I have missed here.

It is rooting and also you can't reach the IC over the APE's port AFAIK (the original question was if it is possible to get fw off the car without root through the APE's port)

 

[Restrected]

It looks like a lot of fun.

While you are hacking did you come across how to set the bit (flag) that the bio-filter is installed? I did not get my car with the bio-filter, but I am willing to add one...

that does not require root. that is a configuration option with toolbox.

do note though that is not just the switch that you turn on in the config. its also harware and sensors that need to be installed.
air quality sensor in the front bumper being one. among interior sensor fo the same thing.
also you might need a harness upgrade since yours might not have all the plugs needed. this is IC Carrier main harness.

regardless, pm me if you have all the hardware installed and ready to go and all you care about is enabling the option in the car.

Anyone willing to privately help me with a firmware extract and redeploy? i am running into a couple of issues.
pm me please.

 

[Restrected]

It is rooting and also you can't reach the IC over the APE's port AFAIK (the original question was if it is possible to get fw off the car without root through the APE's port)

you get access through the firewall if you have a legit toolbox running.
pm me and i will explain.

 

[nemSoma]

you get access through the firewall if you have a legit toolbox running.
pm me and i will explain.

I don't need you to explain, I'm aware how seceth works. Someone asked a bit ago if it was possible to dump firmware from the car without having root, all through the APE port. That's the topic I was replying to

 

[alloverx]

Yes a lot of this stuff is likely trial and error given how many folks have computer experience. i.e. not too difficult.
The more I here about Rocket science seems to be similar, concepts are straight forward enough. You just need money and time to play with it and be aware of what hardware is available and possible create new hardware.
Similar with lithium batteries.