TeslaMate [megathread]

[Mr Miserable]

So after only 3, maybe 4 hours, I'm back up and running.
Did a clean install of Bullseye, Docker and got Teslamate up and running again.
Then restored from compressed backup and Ta daaaa!

It would have been done far quicker if I hadn't forgotten the backup was compressed.
I blame lockdown for befuddling my brain...

 

[acatwith12]

It seems the drives tab reports speed using the calc

> distance / NULLIF(duration_min, 0) * 60 AS avg_speed,

Anyone know why this as opposed to the speed reported in positions table?

 

[init6]

It seems the drives tab reports speed using the calc



Anyone know why this as opposed to the speed reported in positions table?

The speed in the positions table is the speed at that point in time. The speed in the drives tab is the average speed over the period of the drive.
As others have found out, your speed can vary quite a lot between positions updates.

 

[acatwith12]

I really enjoy viewing each Drives tab, and the daily Trip tab - but wish there was a way to combine them so I can see my drive for an entire day or over the course of a day. E.g., today I can't see Trip for yesterday. Anyone tinker with grafana to create such a tab? Either modifying trip tab to include drives from previous X days, or aggregating multiple drives?

 

[MrT3]

I really enjoy viewing each Drives tab, and the daily Trip tab - but wish there was a way to combine them so I can see my drive for an entire day or over the course of a day. E.g., today I can't see Trip for yesterday. Anyone tinker with grafana to create such a tab? Either modifying trip tab to include drives from previous X days, or aggregating multiple drives?

In the top right of the screen you can change the timeframe that Trip looks at:

 

[MrT3]

As others have found out, your speed can vary quite a lot between positions updates.

If you zoom in on a drive you will get sub-second updates, certainly more granular than just looking at the total trip graph.

 

[acatwith12]

In the top right of the screen you can change the timeframe that Trip looks at:
View attachment 759176

-mind blown- tyvm!

 

[init6]

If you zoom in on a drive you will get sub-second updates, certainly more granular than just looking at the total trip graph.

The OP was asking about the Drives tab - not the drive details. You can also have longer periods of time between updates than sub-second.

 

[cwanja]

-mind blown- tyvm!

For what it is worth, you can modify the timeline from any dashboard.

 

[billp0527]

I've been stuck on the Import screen for several hours. Have updated to bullseye. Had been having the same problems as others here. Updated to bullseye, removed Docker, reinstalled Docker, and Teslamate. Put TeslaFi csv files in import folder, updated timezone and started the import. Running on Pi4

Any suggestions?

 

[wayner]

I am not a security expert, but it looks like the 19 year old that hacked into Teslas used a vulnerability from some Teslamate users:

How I got access to 25+ Tesla’s around the world. By accident. And curiosity.

How the heck did a 19 year old from Germany manage to be able to take over more than 25 Tesla’s around the world?

medium.com

Has there been discussion about that in this thread?

I really wanted to know how TeslaMate works. Because… if it is able to pull all the vehicle data it might also have a way to send commands to the Tesla?

After that thought I spent some time reading the TeslaMate source code in order to figure out how the authentication works, how the Tesla credentials flow through the app and where it stored the user’s API key.

Long story short, it does save the API key where it also stores all the other data. The API key is neither stored separate nor is it encrypted.

So, if Grafana can access the vehicle data, and the API key is stored next to the vehicle data, can Grafana read and output the API key?

Well, there is Grafana Explore to run custom queries. This needs authentication tho. What a bummer.

Ever heard about this distant cyber security issue called… “default passwords”? Yep, TeslaMate Docker’s Grafana installation comes with default credentials.

It also is possible to query the tokens as an unauthorized anonymous user without logging in through a Grafana endpoint (see CVE-2022–23126 further below as well as TeslaMate patch v1.25.1 released after private disclosure and the screenshot that is included further below).

I took the shot and tried logging in with admin:admin which, kinda unsurprisingly, but still hilariously it worked.

Building a Query String for Grafana (Explore) and querying the API tokens wasn’t magic after that.

That was the point where I was able to fully confirm that in this case it is indeed possible that some external attacker could do these steps and end up having substantial control over the CTO’s Tesla.

Which I deemed a high to critical security issue. No one should be able to unlock the SaaS company’s CTO’s Tesla doors… So I immediately stopped there and contacted the organization and get this resolved.

 

[MrT3]

I am not a security expert, but it looks like the 19 year old that hacked into Teslas used a vulnerability from some Teslamate users:

How I got access to 25+ Tesla’s around the world. By accident. And curiosity.

How the heck did a 19 year old from Germany manage to be able to take over more than 25 Tesla’s around the world?

medium.com

Has there been discussion about that in this thread?

It’s a reason why I host my own Teslamate server and don‘t expose it to the Internet.

 

[wayner]

It’s a reason why I host my own Teslamate server and don‘t expose it to the Internet.

If I am reading it correctly the vulnerability is that the Grafana docker was exposed to the net and it was using the default password, which is the same for all users.

 

[acatwith12]

I am not a security expert, but it looks like the 19 year old that hacked into Teslas used a vulnerability from some Teslamate users:

How I got access to 25+ Tesla’s around the world. By accident. And curiosity.

How the heck did a 19 year old from Germany manage to be able to take over more than 25 Tesla’s around the world?

medium.com

Has there been discussion about that in this thread?

I mean, what's there to say? I assume if you're smart enough to expose Teslamate to the internet you should also care a thing or two about security and know how to lock it down...

 

[MrT3]

If I am reading it correctly the vulnerability is that the Grafana docker was exposed to the net and it was using the default password, which is the same for all users.

Yes, really just a misconfiguration more than something like a coding bug. But who knows what else is a potential weak point, or what libraries or other code it is relying on that turn out to have an issue in the future.

 

[init6]

I've been stuck on the Import screen for several hours. Have updated to bullseye. Had been having the same problems as others here. Updated to bullseye, removed Docker, reinstalled Docker, and Teslamate. Put TeslaFi csv files in import folder, updated timezone and started the import. Running on Pi4

Any suggestions?

View attachment 759633

What do the logs say?

 

[init6]

Yes, really just a misconfiguration more than something like a coding bug. But who knows what else is a potential weak point, or what libraries or other code it is relying on that turn out to have an issue in the future.

At least with Teslamate you can run it on your own network. Other apps may have vulnerabilities that we are unaware of. Got to be careful who you share those tokens with.

 

[MrT3]

At least with Teslamate you can run it on your own network. Other apps may have vulnerabilities that we are unaware of. Got to be careful who you share those tokens with.

Agreed, hence my previous comment that I run it locally on my network and use a VPN if I need to access it remotely.

 

[Cardo]

Yes, really just a misconfiguration more than something like a coding bug. But who knows what else is a potential weak point, or what libraries or other code it is relying on that turn out to have an issue in the future.

The latest update now forces you to change the password so it can’t be left on the default.
As for vulnerabilities, it’s a piece of software, if anyone looks hard enough they’ll probably find something. To be honest, the best solution would be for Tesla to provide official API support with configurable app privileges.

 

[DM206433]

Wonder if a Teslamate/Grafana guru can help with this. On the statistics page, I'd like to add an additional column that shows costs, but those specific to a geolocation (my home) - so I can basically see home charging costs on a monthly basis. The current column shows overall costs regardless of home charging, supercharging, etc etc. Can anyone help with this please?