Successful connection on the Model S internal Ethernet network

[lolachampcar]

If it is like most other cars on the road, everything of any importance goes over CAN or FlexRay.

 

[brianman]

If Tesla doesn't give clearance for the REST API then why in hell would they give their clearance to snooping in on the internal bus? Seems silly to formally ask the question when you already know the answer. In fact, it makes it worse to ask.

Physical interaction with the device is quite different than talking to already-public-facing servers that answer the requests from the phone app.

I don't think it makes it worse to ask. Probably best to agree to disagree here, or start a new thread if you like.

- - - Updated - - -

Exactly, and just to add to that why do we feel so compelled to communicate our hacking efforts to Tesla when they have repeatedly demonstrated their inability, and general lack of interest, to communicate with us?

You're justifying proposed new bad behavior with old bad behavior. I don't agree.

- - - Updated - - -

From the MVPA I signed way back when ...
View attachment 45430

Yup, this is part of the reason I said what I said.

- - - Updated - - -

Tesla is on the wrong side of this by reaching out to people with warnings. They need to find a way to work with their customers that have legitimate curiosity WRT MS and not against them. We own the car and there are people that will want to tinker. There must be a sane way to allow the curious to feed their need to learn while still protecting Tesla's interests.

I disagree with your first sentence. They should be doing exactly that.

A warning is not a threat.

Example W - Warning
If you put your hand on the stove while it's on, you might burn yourself.

Example T - Threat
If you put your hand on the stove while it's on, I'm going to beat you repeatedly.

The owner can respond with something like your post and ask Tesla how to make both parties happy and begin a productive discussion (in private emails or publicly if both wish) on making that happen.

Rewinding back to my original point: If I was in the shoes of these explorers, I would have reached out to Tesla first rather than waiting for Tesla to reach out to me after having explored. The primary reason is that I value my car too much to risk it for such a side project. When Gen 3 comes out and I find a wrecked used one for $5K, it's a whole different ballgame perhaps.

 

[Gizmotoy]

This evening I got a call from service center :crying:
They told me Tesla USA engineers seen a tentative of hacking on my car...
I explained it was me because I tried to connect the diagnosis port to get some useful data (speed, power, etc...). They told me it can be related to industrial espionage and advised me to stop investigation, to not void the warranty....
Don't know if they really seen something in the log, because I just sniffed the network. Or maybe they seen the port scanning with nmap ? Or maybe they just read this topic ?

Industrial espionage has a defined meaning, and this is clearly not industrial espionage. It's not performed clandestinely, and it's not for commercial gain.

In all liklihood, they just saw this post on the forum. My SC informed me that Ownership maintains full-time staff to monitor TMC and Tesla's own forums, and accurate or not, I wasn't surprised.

I am somewhat surprised, though, that a company founded and run by an engineer like Elon would be making warning calls to someone passively listening to data passing along an easily-accessible port.

I agree with you. But this ethernet port is probably not only a diagnosis port, we seen that we can access some internal communications, and maybe change some internal parameters. That's the problem, they explained me let's imagine I am able to remove the speed limitation, or boost the power. If my motor die, it will be my fault, not Tesla fault, and they will not change my motor under warranty.
It's an extreme case, but we don't know (and the Tesla employee who called me too), what can be done through this diagnosis tool, with or without hacking exploit.

I think if we just connect the port, and just capture data, they cannot do anything because I think they cannot see the connection. Or they can see the ethernet connection going "up" somewhere.

If it's possible to remove speed limiters or boost power using only this port and a little snooping, you can pretty much guarantee they just caused a bunch of tuners to start drooling. You'd think modifying that kind of stuff would have even rudimentary protection instead of being sent in the clear where it's easily-observed and modified on a user-facing port. I strongly suspect that those are protected, which makes their statement odd.

Tesla is on the wrong side of this by reaching out to people with warnings. They need to find a way to work with their customers that have legitimate curiosity WRT MS and not against them. We own the car and there are people that will want to tinker. There must be a sane way to allow the curious to feed their need to learn while still protecting Tesla's interests.
This issue of providing tools to work on their cars is going to start cropping up more and more as time goes by. They can hold it off for a few years with their excellent warranty work but it will crop up. Unlike the dealer thing, they will be on the wrong/loosing side of that argument.

It looks like Tesla's about to follow Mitsubishi and take a hard line on mods, though it appears they're poised to take it a step further. I mentioned in another thread that when I picked up my backup camera part yesterday I was warned not to install the front camera switch under development or they'll consider my warranty voided (though I won't get clarification as to what their stance is exactly for a few weeks when the car's in again).

Tesla of 6 months ago got a kick out of your remote charge port opener. I wonder if they'd take the same position today? Especially considering you can walk up to any Tesla that's not asleep and open the charge port (even if it's locked).

 

[jiaotong]

We own the car and there are people that will want to tinker.

I can imagine while owning the car, physically, you are in your rights to tinker with physical things. However, I would imagine you have a license for the soft/firm ware which runs the car and are not free to tinker. license != ownership.

Like owning an iPhone, you have a license for the OS which runs on it. While you could jailbreak it, if you overcome any locks you may run into a DRM issue. I think Tesla would take a similar approach.

of course, my own .01 ( not sure if my words are really even worth .02 )

I think this could fall under a DRM issue which

 

[DEinspanjer]

They told me it can be related to industrial espionage and advised me to stop investigation, to not void the warranty....

nlc didn't provide a transcript of the call (which I wouldn't really expect , but the most important part to me is the part I bolded above. What he relayed to us doesn't sound very much like a threat or even an angry attempt to prevent people from tinkering, but rather a piece of advice that if he continues, it could very well void his warranty.

He mentions that they said it could be related to industrial espionage, but I don't think we have enough context to construe much from that part. They might have been justifying how they discovered it or why they investigated or reached out to him.. Or maybe they were rude and threatening, little way for us to tell that.


I do very much hope they release a solid API and allow integration and customization.. I sorta doubt they will, but I hope. I am definitely a proponent of the idea that transparency and many eyes make more secure and reliable code. But I think that unless Tesla does reach out and embrace that, the curious and the tinkers will continue to run the risk of financial loss from warranty or insurance cancellation.

 

[brianman]

(Removed by request.)

I'll be brief. As a programmer I found this post insulting and misdirected.

 

[lolachampcar]

Sorry for the insult. It was not intended. I just needed to rant a bit.

 

[aviators99]

Personally, (as a programmer and technologist), I think it would be great if we could keep this particular thread about the findings and ideas. Another thread on legality and morality would be useful (but not of interest to me).

 

[apacheguy]

Industrial espionage has a defined meaning, and this is clearly not industrial espionage. It's not performed clandestinely, and it's not for commercial gain.

+1. And even setting aside such a strong term as espionage, I don't see how Tesla would spin this one in the courts (if it ever got to that level). They'll go the same way as Apple and jailbreakers and that would be unfortunate.

Personally, (as a programmer and technologist), I think it would be great if we could keep this particular thread about the findings and ideas. Another thread on legality and morality would be useful (but not of interest to me).

Unfortunately there won't be many findings to speak of if Tesla keeps these warnings up, which is precisely why the discussion has taken this turn.

 

[Electroman]

The findings will go on, but you will hear of it less and less here and more in private select closed groups that Tesla will never find out.

The best for Tesla and for that matter any company is to embrace these positive beneficial hackings and learn the vulnerabilities, before an oil funded effort releases a virus out.

 

[dsm363]

Personally, (as a programmer and technologist), I think it would be great if we could keep this particular thread about the findings and ideas. Another thread on legality and morality would be useful (but not of interest to me).

Agree. If someone wants to create that thread in the Off Topic area then that would be best.

 

[Schmo]

Personally, (as a programmer and technologist), I think it would be great if we could keep this particular thread about the findings and ideas. Another thread on legality and morality would be useful (but not of interest to me).

+1. Sadly, more and more interesting threads on TMC are getting sidetracked by rants and whining. Last year the SNR was much better...

 

[aviators99]

The findings will go on, but you will hear of it less and less here and more in private select closed groups that Tesla will never find out.

The best for Tesla and for that matter any company is to embrace these positive beneficial hackings and learn the vulnerabilities, before an oil funded effort releases a virus out.

Agreed. And consider this a plea to be invited to any such groups. I am very trustworthy (I'm a YPO Member, in case there are any others here who belong to that cult and would understand what that means, in terms of confidentiality).

 

[apacheguy]

Agree. If someone wants to create that thread in the Off Topic area then that would be best.

I don't see how this is off topic as it is very much relevant to the issue being discussed.

 

[dsm363]

I don't see how this is off topic as it is very much relevant to the issue being discussed.

A thread on the morality of hacking software isn't specific to the Model S since this would apply to Model X, Gen III....etc so that's why I suggested Off Topic but that was just a suggestion. Can always split that discussion out as was mentioned.

 

[Hank42]

Agreed. And consider this a plea to be invited to any such groups. I am very trustworthy (I'm a YPO Member, in case there are any others here who belong to that cult and would understand what that means, in terms of confidentiality).

Who We Are YPO ??

 

[aviators99]

Who We Are YPO ??

Yeah. That cult.

 

[yobigd20]

We own the car and there are people that will want to tinker.

Apple would disagree with you

- - - Updated - - -

We own the car and there are people that will want to tinker.

Apple would disagree with you too haha

 

[aviators99]

Apple would disagree with you

- - - Updated - - -



Apple would disagree with you too haha

And the EFF disagreed with Apple, and the EFF won.

 

[Gizmotoy]

And the EFF disagreed with Apple, and the EFF won.

This is not really the same as the Apple case anyway. There Apple had protection mechanisms that had to be bypassed in order to jailbreak the devices. Since the DCMA has an anti-circumvention clause that makes that illegal, an exemption had to be sought. It's currently legal because the EFF successfully fought for the exemption, but could be made illegal again at any time by failing to renew the exemption.

Here, there's no protection whatsoever against viewing the data (the traffic on the Ethernet bus is readily visible and isn't encrypted), but owners have signed a license that prevents reverse engineering. Whether those terms can be enforced varies by jurisdiction (by state in the US). Apple doesn't do anything like that.

So, two very different situations.