Odd Web Accesses Made by Gateway

[Sylvia Else]

I've been looking at the traffic between the powerwall 2 gateway and the internet. Most of it is encrypted, and since I have no access to the certificate store on the gateway, the usual man-in-the-middle attack can't be implemented.

However, some traffic is in plain text. One of the oddest things the gateway does from time to time is to access the home page of google.com. It gets redirected to www.google.com, so it retrieves that home page instead. But it doesn't do anything with it.

Maybe that's its criterion for deciding whether it has internet access, though I'd have thought a better way would be to attempt to access the servers that are dedicated to it.

Alternatively it may not be something Tesla have done deliberately, but be inherent in the software they based the gateway firmware on. Perhaps it's an embedded Android system, since that would give them the cell and wifi connectivity out of the box. The wired network might then be via a usb to ethernet bridge.

This is all speculation, of course....

 

[fresnoboy]

I suspect the google.com fetch is a Internet connectivity test. Google is almost never down, so if it cant be reached, it means there is an issue with Internet connectivity.

Yes, there are more sophisticated ways of doing this, but clearly they did a hack.

It's good to know though, as with most IOT sort of devices, I lock down connectivity in my firewall/IDS so they can't talk to anything more than they need to.

 

[Sylvia Else]

I've noticed that it makes https connections to the same servers. The http connections identify themselves as Go-http-client/1.1.

More than one megabyte in a couple of days.