Successful connection on the Model S internal Ethernet network

[Olen]

I would use 802.11x, with authentication against Teslas internal systems.
Easy to set up, and quite secure.
Also easy to add new users temporarily if necessary.

 

[chickensevil]

To be clear, I mean disabled so that there is no traffic. I realise that the port is physically up (and negotiable), but it is pretty trivial to shut down all traffic to/from that port (so long as the port is individually addressable).

If they wanted to stop 'us' from playing with the port, but keep it usable by engineers, putting an on/off setting in the DIAG menu of the car is my best guess (that is how I would do it).

If that is the case, is there anyone out there who still had access to the "maintenance" console? (pressing and holding the T at the top of the screen for like 30 seconds). I know people had access but based on the request of Tesla people kept that access to themselves. I would just ask that they go in, and see if it is a new menu option. If so then that will solve that and keep people from wasting their time

Also, I feel like it is inevitable that Tesla and other car makers are going to have to continue to up their security on the cars. Given some of the terrible things you can do, even to basic cars like a prius if you have access to the CAN, this is certainly something that the entire industry needs to work on.

That being said, I do think, on some level Tesla needs to break down and give people some control and some level of access. Even if it is a walled garden to play in... Because otherwise people are not going to quit until they get what they want. Which in this case, is primarily driven by the desire to modify certain aspects of the car. Most hacks of this nature is totally non-malicious in nature, and in the result of the company not really giving people what they really want. It then opens the door to other nefarious purposes since now the hard work has been done. I point to the PS3 as the leading example of this in action.

 

[wk057]

Keep in mind that a lot of the hardware on the Model S is based on FPGA/CPLD devices, as revealed in this very thread. So, changes can be made to hardware/software at a very low level. If this ethernet connection was controlled by something programmable like this (pretty likely) they could do virtually anything they want with this port, as well as "physically" disconnect it from the rest of the internal network.

 

[Eggplant]

If it is 802.11X authing to Fremont, how would the rangers deal with connecting to the car in an areas without cell service? There must be some sort of local auth going on.

 

[andrewket]

To be clear, I mean disabled so that there is no traffic. I realise that the port is physically up (and negotiable), but it is pretty trivial to shut down all traffic to/from that port (so long as the port is individually addressable).

If they wanted to stop 'us' from playing with the port, but keep it usable by engineers, putting an on/off setting in the DIAG menu of the car is my best guess (that is how I would do it).

Agree. This is how I would do it too.

 

[wk057]

Would be bad if they needed the center screen diagnostic menu to activate the port if they were trying to use the port to investigate an issue with the center screen.

I'll stick to their being some type of auth on the port itself. Could be as simple as a magic packet to some magic address or something silly... maybe someone should wire up to sniff traffic on this port and then go in for service. lol.

 

[Olen]

If it is 802.11X authing to Fremont, how would the rangers deal with connecting to the car in an areas without cell service? There must be some sort of local auth going on.

But are we sure that they are able to connect to the ethernet port without some kind of wireless or cell service?

Of course the switch could cache some auth info, but requiring some connection back to the mothership would be easier.

 

[finout]

Talked to a tech a few days ago.

The port is turned off until the car is told (by Tesla, via 3G or wifi) to activate it. The "Tesla service application" (only available to Tesla service people on Tesla authorized laptops) must be running.

There is a round trip communication from the laptop over the internet to the Tesla servers that gives the car the command to activate the Ethernet port. At that same moment, the Tesla service app knows to try to connect.

Won't be very easy to foil this method.

 

[chickensevil]

Well that's unfortunate, but thanks for finding out about this for us.

 

[jcstp]

Split in half: Tesla crash bolsters safety claims

KTLA reported that the chase began after a Tesla dealership reported the car was being tampered with on its lot.

 

[apacheguy]

Talked to a tech a few days ago.

The port is turned off until the car is told (by Tesla, via 3G or wifi) to activate it. The "Tesla service application" (only available to Tesla service people on Tesla authorized laptops) must be running.

There is a round trip communication from the laptop over the internet to the Tesla servers that gives the car the command to activate the Ethernet port. At that same moment, the Tesla service app knows to try to connect.

Won't be very easy to foil this method.

Hmm, and what about cars that are out of network coverage, or their touchscreen is malfunctioning? There must be another way in that does not rely on an external link.

 

[Johan]

Hmm, and what about cars that are out of network coverage, or their touchscreen is malfunctioning? There must be another way in that does not rely on an external link.

Yes, or malfunctioning networking hardware???

 

[idler]

Took a look at what's behind the dashboard yesterday. Good news are:
- There is a ethernet and power/CAN port behind dashboard
- The same pin out still works
- LAN tapping device also works :biggrin:
- IP addrs didn't change

Bad news:
- Still need to figure out how to send traffic, may be a device to switch between dashboard and another port?

 

[Bugeater]

Hmm, and what about cars that are out of network coverage, or their touchscreen is malfunctioning? There must be another way in that does not rely on an external link.

This is simple. All Model S's have built in Wi-Fi connections to Tesla's Wi-Fi. Simply making the service laptop be a hotspot with the right credentials will give access to anything they want...

 

[widodh]

Took a look at what's behind the dashboard yesterday. Good news are:
- There is a ethernet and power/CAN port behind dashboard
- The same pin out still works
- LAN tapping device also works :biggrin:
- IP addrs didn't change

Bad news:
- Still need to figure out how to send traffic, may be a device to switch between dashboard and another port?

Nice! So they simply blocked the 'easy way' of access.

How do you actually remove the center console? Since then you could attach a fixed cable to the back and still have your way into the systems.

 

[apacheguy]

This is simple. All Model S's have built in Wi-Fi connections to Tesla's Wi-Fi. Simply making the service laptop be a hotspot with the right credentials will give access to anything they want...

Not if the touchscreen is down (or networking hardware, as Johan pointed out).

 

[Doug_G]

Hmm, and what about cars that are out of network coverage, or their touchscreen is malfunctioning? There must be another way in that does not rely on an external link.

The other day my tech tried to upgrade firmware, but 3G sucked and it wouldn't work via WiFi.

 

[Alexander]

This is awesome! Id love to tap into the rear camera for recording. Instead of installing an aftermarket rear dash cam, it would be awesome to just use the one that's already there.

 

[chickensevil]

This is awesome! Id love to tap into the rear camera for recording. Instead of installing an aftermarket rear dash cam, it would be awesome to just use the one that's already there.

And this is but one of many good reasons to let people have their way with the cars hardware... just saying.

I am glad to hear that all is not lost!

 

[idler]

Nice! So they simply blocked the 'easy way' of access.

How do you actually remove the center console? Since then you could attach a fixed cable to the back and still have your way into the systems.

Nope, I didn't remove the center console, just the dashboard module
I only attached tapping device (with Rx and Tx redirected to two tapping ports' Rx respectively). May be a pure hub would be useful here. Will try again next time :biggrin: