Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Successful connection on the Model S internal Ethernet network

This site may earn commission on affiliate links.
sorry if this was already mentioned, I read this thread over two days.

regarding the NFS stuff.. try showmount -e <ip address> using the IP of the system that has the NFS port open.

(so long as you're on a linux / mac / whatever that has everything running that is needed to mount NFS file systems)
 
Congratulations on getting this far.

If you find some evidence of what (third party) software they're running, I'd like to know. I'm expecting to see a copy of Busybox.

Frankly I think we might be able to figure out some of the vampire power drain problems if we understand what Tesla's using.
 
So I just connected to my Model S and I can see the same as nlc found. The connection is 100Mbit and I used the B schematic for my own cable.

NFS
I ran a 'showmount -e' against 192.168.90.100 and there is one NFS mount: /opt/navigon

root@wido-laptop:~# showmount -e 192.168.90.100
Export list for 192.168.90.100:
/opt/navigon 192.168.90.0/24
root@wido-laptop:~#

Mounting it was no problem. I chose 192.168.90.254 as my IP-address.

192.168.90.100:/opt/navigon on /tmp/navigon type nfs (rw,addr=192.168.90.100)

A simple "ls -al" in the NFS mount:

root@wido-laptop:~# ls -al /tmp/navigon/
total 48
dr-xr-xr-x 5 1111 1111 4096 Mar 21 2013 .
drwxrwxrwt 20 root root 20480 Mar 18 17:01 ..
dr-xr-xr-x 4 1111 1111 4096 Mar 21 2013 EU
dr-xr-xr-x 2 1111 1111 4096 Mar 21 2013 lost+found
-r--r--r-- 1 1111 1111 7244 Mar 21 2013 MD5SUM-ALL
dr-xr-xr-x 2 1111 1111 4096 Mar 21 2013 sound
-r--r--r-- 1 1111 1111 150 Mar 21 2013 VERSION
root@wido-laptop:~#

The VERSION file contained some information which might be interesting:

root@wido-laptop:~# cat /tmp/navigon/VERSION
UI/rebase/5.0-to-master-238-g734c31d7,EU
NTQ312_EU,14.9.1_RC1_sound.tgz
build/upgrade/mknav-EU-ext3.sh
yzadik-MacBookPro Thu Mar 21 11:40:59 PDT 2013
root@wido-laptop:~#

So Yzadik build this navigation ext3 filesystem for the EU about 1 year ago :)

root@wido-laptop:~# df -h /tmp/navigon/
Filesystem Size Used Avail Use% Mounted on
192.168.90.100:/opt/navigon 4.1G 4.1G 0 100% /tmp/navigon
root@wido-laptop:~#

It's probably a loopback device on the center screen, but I can't be sure.

SSH
Afterwards I tried to SSH in, but all the combinations I could think of this time didn't work, so I gave up the SSH for now.

But I did do a quick telnet to get some version information:

root@wido-laptop:~# telnet 192.168.90.100 22
Trying 192.168.90.100...
Connected to 192.168.90.100.
Escape character is '^]'.
SSH-2.0-OpenSSH_5.5p1 Debian-4ubuntu4
^]quit

telnet> quit
Connection closed.
root@wido-laptop:~#

So it seems to be Ubuntu which is running on there? Well, at least a modified version of Ubuntu.

192.168.90.100 and 192.168.90.101 are both running the same version of OpenSSH.

DNS
On 192.168.90.100 there is also a DNS server running on port 53. It's a recursive nameserver which is open for me:

root@wido-laptop:~# dig Tesla Motors Club - Enthusiasts & Owners Forum @192.168.90.100

; <<>> DiG 9.8.1-P1 <<>> Tesla Motors Club - Enthusiasts & Owners Forum @192.168.90.100
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10940
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;Tesla Motors Club - Enthusiasts & Owners Forum. IN A

;; ANSWER SECTION:
Tesla Motors Club - Enthusiasts & Owners Forum. 300 IN CNAME teslamotorsclub.com.
teslamotorsclub.com. 300 IN A 64.111.70.28

;; Query time: 44 msec
;; SERVER: 192.168.90.100#53(192.168.90.100)
;; WHEN: Tue Mar 18 17:07:52 2014
;; MSG SIZE rcvd: 71

root@wido-laptop:~#

I also queried to find out which DNS server it's running:

root@wido-laptop:~# dig @192.168.90.100 -c CH -t txt version.bind

; <<>> DiG 9.8.1-P1 <<>> @192.168.90.100 -c CH -t txt version.bind
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1101
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;version.bind. CH TXT

;; ANSWER SECTION:
version.bind. 0 CH TXT "dnsmasq-2.58"

;; Query time: 1 msec
;; SERVER: 192.168.90.100#53(192.168.90.100)
;; WHEN: Tue Mar 18 17:09:12 2014
;; MSG SIZE rcvd: 55

root@wido-laptop:~#

So that seems to be dnsmasq 2.58

That's weird. Since Ubuntu 10.04 (previous LTS) has dnsmasq 2.52 and the current one, 12.04 has 2.59. So this has to be a homebrew version of Ubuntu OR a non-LTS version of Ubuntu.

HTTP
So 192.168.90.100 is running a webserver which serves one file only: nowplaying.png:

root@wido-laptop:~# curl -v -o /dev/null http://192.168.90.100/nowplaying.png
* About to connect() to 192.168.90.100 port 80 (#0)
* Trying 192.168.90.100... % Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0connected
> GET /nowplaying.png HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1 zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: 192.168.90.100
> Accept: */*
>
< HTTP/1.1 200 Ok
< Server: mini_httpd/1.19 19dec2003
< Date: Tue, 18 Mar 2014 16:13:05 GMT
< Content-Type: image/png
< Content-Length: 14277
< Last-Modified: Tue, 18 Mar 2014 16:12:23 GMT
< Connection: close
<
{ [data not shown]
100 14277 100 14277 0 0 1758k 0 --:--:-- --:--:-- --:--:-- 2323k
* Closing connection #0
root@wido-laptop:~#

We can assume that 192.168.90.101 (the dashboard) downloads this file to display the same image on the dashboard. I tried a couple of HTTP urls, but they all failed.

mini_httpd 1.19 seems pretty old though! 19 dec 2003? But the website says it's the latest version: mini_httpd

I still would have gone for something like nginx or lighttpd, but hey, it's up to them. It's also available as a package on Ubuntu: Ubuntu – Details of package mini-httpd in precise

X11 / XDMCP
Using remmina in Ubuntu I was able to set up a X11 connection on port 6000, but it only showed me a blank screen, nothing else.

This was on both .100 and .101. Could be that I did something wrong.

IPv6
I tried to connect to the internal IP's using IPv6, but all three hosts didn't respond on the link-local address I calculated based on their mac address.

Broadcast UDP traffic
I also see all this UDP traffic. I ran tcpdump for about 2 minutes and I'll try to see what it actually contains.
 
The VERSION file contained some information which might be interesting:



So Yzadik build this navigation ext3 filesystem for the EU about 1 year ago :)

Thsi must be the guy who worked on the navigation system:
Yair Zadik | LinkedIn
3f9e262.jpg
 
How about an ls -alR of the NFS mount? I assume that the EU subdirectory has the navigation data for the EU. I guess the sound subdirectory is the voices.
I'm not connected anymore, but what I saw:

The EU directory is about 3GB in size and has two subdirectories:
- maps
- data

In all has some .pfs and .nfs files

The sounds directory indeed has the voices. For every different language there is a .pfs file.

No NFS mounts on .101?
Nope, only .100 does NFS.
 
Hi everyone,

from a discussion with a TM employee I can confirm that they run a modified version of Ubuntu.
He further told me, that they use Qt.
But even more interesting (may not for this thread but in general) they use 6 CAN-Buses (AFAIK other Cars use maximum 3).


Maybe that's why there's such a limited selection of things that we can go to via the smartphone app / "REST API"
 
Nice detective work on the versions, widodh. That http server does indeed seem quite old. Might provide a way in through exploits?
Maybe indeed. Not sure yet.

A Quick google brought me to a remote execution exploit though: Acme Mini Httpd version 1.19 : Security vulnerabilities

Couple of things which are on my TODO list:

- Reboot main screen and see if it tries a PXE boot or does any DHCP requests
- Reboot both screens and check the same
- Cause a IP-address conflict and see what traffic I get in or what happens (Keep the frunk open to pull any fuses if a reboot is required)
- Try to exploit the HTTP server
- Try a brute-force on the SSH (probably won't work..)
 
Great Widodh ! Actually in hollidays I will be able to continue investigation the next week. From my reboot test, I remember no dhcp or pxe request. But you can also try if I missed them.
Will try to concentrate on the 3h device which seems to countain data from powertrain
 
Maybe indeed. Not sure yet.

A Quick google brought me to a remote execution exploit though: Acme Mini Httpd version 1.19 : Security vulnerabilities

Couple of things which are on my TODO list:

- Reboot main screen and see if it tries a PXE boot or does any DHCP requests
- Reboot both screens and check the same
- Cause a IP-address conflict and see what traffic I get in or what happens (Keep the frunk open to pull any fuses if a reboot is required)
- Try to exploit the HTTP server
- Try a brute-force on the SSH (probably won't work..)

This is great stuff and very interesting, but I just want to toss in a word of caution, maybe paranoia. :) Given that the car is always connected and definitely phoning home, it is very possible that even the basic investigation work you've done so far, something as simple as registering a new client on the LAN might be reported back in the form of a syslog somewhere. Exploit attempts on the HTTP server or brute forcing the SSH daemon are even more likely to show up in auth logs and such that might work their way back, if not as actual text dumps, then possibly as audit counters such as reporting the number of failed logins or 404 requests, etc. I have no idea how Tesla will react to this information if they do collect and notice it, especially coming from a curious owner, but I think it is a possibility because they might be interested in how and what their competitors are reverse engineering from the cars, not to mention being prepared to react to the eventual likelihood of someone cracking into the cars for nefarious purposes such as being able to enable a high-tech theft ring.
 
This is great stuff and very interesting, but I just want to toss in a word of caution, maybe paranoia. :) Given that the car is always connected and definitely phoning home, it is very possible that even the basic investigation work you've done so far, something as simple as registering a new client on the LAN might be reported back in the form of a syslog somewhere. Exploit attempts on the HTTP server or brute forcing the SSH daemon are even more likely to show up in auth logs and such that might work their way back, if not as actual text dumps, then possibly as audit counters such as reporting the number of failed logins or 404 requests, etc. I have no idea how Tesla will react to this information if they do collect and notice it, especially coming from a curious owner, but I think it is a possibility because they might be interested in how and what their competitors are reverse engineering from the cars, not to mention being prepared to react to the eventual likelihood of someone cracking into the cars for nefarious purposes such as being able to enable a high-tech theft ring.
I'm not hiding anything. If I can find a vulnerability in Model S, somebody else can as well. I'm doing it in public so Tesla can learn from it.

Somebody else might do it without Tesla knowing and could be stealing cars from the owners.

I suspect that is why this work is being done out in the open......
Exactly. If I find something which is very serious I'll contact Tesla to make sure they can fix it.

...and I can pretty much guarantee that Tesla already knows about this happening. :)
That can only help them to make Model S and the upcoming models even better.
 
I'm not hiding anything. If I can find a vulnerability in Model S, somebody else can as well. I'm doing it in public so Tesla can learn from it.

Somebody else might do it without Tesla knowing and could be stealing cars from the owners.

Exactly. If I find something which is very serious I'll contact Tesla to make sure they can fix it.

That can only help them to make Model S and the upcoming models even better.

I think that is the right way to do it. If you find anything serious let Tesla know in private first and give them opportunity to address it in a timely manner.
 
So I just connected to my Model S and I can see the same as nlc found. The connection is 100Mbit and I used the B schematic for my own cable.

NFS
I ran a 'showmount -e' against 192.168.90.100 and there is one NFS mount: /opt/navigon
Enjoying the thread. I hung up my Unix hacking years ago but I can tell you that Navigon is the company that provides the turn-by-turn navigation system for the dashboard screen. That is the filesystem location of the street database where they will upload new maps/databases - same as when you update your handheld Garmin, Tom Tom, etc GPS unit. Navigon is owned by Garmin.
| NAVIGON - a Garmin company.