-
Want to remove ads? Register an account and login to see fewer ads, and become a Supporting Member to remove almost all ads.
Successful connection on the Model S internal Ethernet network
- Thread starter nlc
- Start date
-
- Tags
- Model S User Interface
GaryREM
Member
I'm personally glad they have locked things down. This is not hostile, it's good business sense.
What I want to see is a dev kit that allows you to enhance certain portions of the system in a limited, consistent, reliable manner.
What I want to see is a dev kit that allows you to enhance certain portions of the system in a limited, consistent, reliable manner.
dirkhh
Middle-aged Member
Many ways to do that. Either they open up Ethernet via a command on the CAN bus or they have a magic packet that they send to the switch that unlocks things or...
sounds like they went to unicast only traffic and either turned off ping responses or changed the ip's of the units.
You give up too easily.
if you want to continue, here's an idea.
Trace the cable and find the switch.
Make adapters for each ethernet cable going into the switch to standard rj45. Good adapters.
connect them to a standard hub instead and you'll be able to see all traffic and not just broadcast.
when done logging just connect them back to their original switch.
islandbayy
Active Member
don't have time to read whole thread eithrt now, however if it hasn't been mentioned yet, all this data traffic is now fully encrypted, and vehicle must now have active data connection either via cellular or wifi to Tesla's systems for access. apearantly, it was because of you sniffing the traffic and attempting access that they did this.
chickensevil
Active Member
what constitutes a connection to Tesla's systems for access? I vote you try a replay attack to trick the system into thinking you have access to their systems 
EarlyAdopter
Active Member
what constitutes a connection to Tesla's systems for access? I vote you try a replay attack to trick the system into thinking you have access to their systems
The car's connection back to the Mothership is over an encrypted OpenVPN connection. No replay attack opportunities there.
It seems the connection was killed somehow "physically".
I was thinking of changed IP addresses etc, so I tried rebooting the main display by holding both wheel buttons on the steering wheel.
ARP query was expected to be broadcasting from IP address of the main display when it started talking to other components like dashboard. However nothing was captured.
I thought you said the ethernet link went up as expected?
ARP querys can be turned off. They're not really needed if you only have known devices on a closed network.
The link still comes up, but no traffic at all.
Yes, you can set static ARP entries, but all cars will have different MAC addresses for their devices, so I doubt that's it.
Maybe they simply put that port into a VLAN of it's own?
Maybe. If the switch supports vlan's.
As for ARP, you can do a discover once kind of thing wherr the devices discover each other the first time they start and then store that info.
On these kind of small closed networks that you want to expose for service but make hard to hack you can do all sorts of relatively easy things that makes it much harder...
Or it could be that the network is already isolated by a router and the routing can be enabled or disabled by CAN command or remotely?
Since the network transporyed data between dashboard and center displays, probably not.
Then the ethernet link wouldn't go up either.
To be clear, I mean disabled so that there is no traffic. I realise that the port is physically up (and negotiable), but it is pretty trivial to shut down all traffic to/from that port (so long as the port is individually addressable).
If they wanted to stop 'us' from playing with the port, but keep it usable by engineers, putting an on/off setting in the DIAG menu of the car is my best guess (that is how I would do it).
Similar threads
