Tesla's response to me leaking info about the P100D?

[schonelucht]

The vector is the hardest part. Being that the car is Linux, there are only a few ways wk057 was able to get root.

No need to guess since it's pretty easy to put two and two together if you read the first pages in the 'on the bench' thread. Injecting strange stuff on the canbus should be enough.

 

[Btr_ftw]

I won't lie, I didn't read this whole thread. The second I saw that someone at Tesla was trying to get into wk's car I prepared myself for the poop storm.

That being said, I'm sure we can all agree the best way to get back at Tesla is to make sure a flooded salvage car gets back on the road successfully.

That should really piss them off

 

[Drumheller]

Then you'll know that a properly salted SHA256 hash is quite literally *impossible* to break with even the entire world's computing resources combined in less than, oh I don't know, the remaining life of the universe?

With current public knowledge, yes. Of course, new things are being discovered and even the field of mathematics changes over time.

However, all of this dances around the point. You shouldn't have shared the info in any format. Clearly, you aren't willing to acknowledge that.

 

[kennybobby]

snippiness alert

I'm beginning to think WK is a lightening rod for the ignorant.

That's why it's called the ignore list--keeps getting longer everyday

 

[ohaq]

Thank God got to the end of thread, now I can go back to work. Some people have to work you know.

Will come back when i get bored. Oh and WK 'YOU MADE ME LOOK'.

Can we get some leaks about model 3 now. i can't afford 100D

 

[satoshi]

That being said, I'm sure we can all agree the best way to get back at Tesla is to make sure a flooded salvage car gets back on the road successfully.

That should really piss them off

I don't think it's productive to really be seeking "revenge" or "pissing off anyone" deliberately...

Tesla, TMC, wk, everyone needs to be working toward diplomatic and peaceful conflict resolution.

So on that note, what's been done is done stop pointing fingers at each other, and get back to promoting the quality development of EVs guys.

With current public knowledge, yes. Of course, new things are being discovered and even the field of mathematics changes over time.

However, all of this dances around the point. You shouldn't have shared the info in any format. Clearly, you aren't willing to acknowledge that.

Additionally, I'm going to write an apology to the few contacts I have at Tesla for whatever trouble I've caused with my unintentional information leak. I'd like to hope that I'm at least a moderately valuable ally to Tesla, overall.

As you can see he clearly has acknowledged it in the best way he can.

 

[deonb]

for most password storage solutions in use on forums and stuff, the salt is not random at all, nor does it need to be, as long as the salt stays secret. Adding iterations to a hash can also prevent most brute force attacks, no salt needed.

Please tell me which system's security depend on the salt being secret, rather than it being unique, and I'll be sure to stop visiting it!

The purpose of a salt in a password is to protect against a rainbow table attack by effectively requiring a different rainbow table for each user in the system, which would defeat the purpose. If you use the same salt for every user, if the salt is ever determined, you'll be able to once again create a common rainbow table to give you every password in the system.


In general, any security solution that relies on "as long as x stays secret" is broken from the get go.

 

[Btr_ftw]

I don't think it's productive to really be seeking "revenge" or "pissing off anyone" deliberately...

Tesla, TMC, wk, everyone needs to be working toward diplomatic and peaceful conflict resolution.

 

[Johan]

Funny anecdote: before "cracking" wk's hash I did try to reverse decode looking for the term "salt" used as salt

 

[jgs]

It's pretty much obvious to everybody that Tesla can access and change the firmware on their cars. While you own your car, I don't think you own the firmware in any real sense. So if Tesla wants to upgrade, downgrade, or not change your firmware ever again I don't think there's much you can complain about -- it's theirs to operate the way they think best. You really don't have any rights to any particular version.

In fact, I don't think it would be unreasonable for Tesla to require some sort of heartbeat (regular connection to the mothership) in order to keep the vehicle functioning. That would mean that if somebody refused connection of any sort then their car would stop working. I think Tesla could get away with requiring this for safety reasons. If you don't like the idea, don't buy the car. Safety first!

Not that I'm particularly in favor of this sort of authoritarian approach on the part of Tesla. But I find it pretty amusing how people are posturing about their rights when they really have none. I suppose you might argue you have the right to the firmware that was originally delivered with your car, but beyond that....

Until there's case law I think any assertions of what Tesla (or a Tesla owner) can or can't get away with are premature. I think BobV's comment, way up-thread, captures it nicely:

Man asks his lawyer: "Is this legal?"
Lawyer: "Yes, if you're acquitted."

Just substitute "Tesla" for "Man". But I wouldn't want to be the lawyer trying to explain to a judge how there was an implicit agreement on the part of the buyer that Tesla could brick their car. I'm also reminded of some of the best legal advice I ever paid to receive, which is that it's better not to be sued to begin with, because once you're in court only the lawyers win.

 

[apacheguy]

"once you know how to do it" is the key here. Finding out how is the non-trivial part. Btw, are you saying you can get root shell access on any MS without disassembling the car to get access to internal ports (other than service ethernet) and without knowing the unlock code? If so, it sounds like an exploit to me. I understand by the way that once you're in, you can backdoor your own car (which would likely be the one of the first things I would do if I took the time to root my car).

I'm surprised wk's backdoor has survived as long as it has. Apple, for instance, reapplies permissions and locks the file system after each update. There is no way you can "backdoor" a jail broken iPhone and update it to the latest OS with the expectation that it will retain its jailbreak status.

 

[LetsGoFast]

FWIW, I was out of town Thursday-Sunday. I received the update, but didn't want to install it mid-trip in case something went wrong. The new software was never pulled from my car -- I saw it every day until I finally installed it last night. Presumably no one seriously doubts that they individually targeted wk's car at this point, but I figured I'd add a data point just in case.

 

[tga]

I don't think it says what you may think it says.

 

[jkk_]

Spoken like a college student with a limited view of the world and life experience.

Why attack against the person though?

 

[MarkS22]

"once you know how to do it" is the key here. Finding out how is the non-trivial part.

And Tesla is aware that people already have this access. So, if seeing information in plain-text (or jpg form) would reveal something top secret, they obviously aren't trying to keep it top secret. There's no other way to see it. People have talked about the location of the Ethernet port and SSH access for two years. It was highly documented at the Def Con Hacking Conference, where Tesla was provided with all the details.

Given this technical but publicly-addressed method for accessing the network gives plain text insights, I just don't see why there's any drama at all. We're essentially belittling Tesla's security protocols at this point.

I think people hear "Linux" and "hacking" and start getting more concerned than they should. There's plenty of information on these forums not covered by IP laws (like "I got my Production version 250 delivered today!", "My Ludicrous upgrade was scheduled today!"), that can more directly influence Tesla and its competitors. Investors and analysts are looking for production/delivery times/ramps much more than speculation on battery size increases.

And to talk about wk057's "ego"? Really? Many in this thread have a signature with their $80,000-$100,000+ vehicle displayed in it. (Myself included, not pointing fingers.) People with low numbers or Signatures/Founders (rightfully) boast about that as well. They're saying "Look, I was into this Tesla before it was mainstream." And they're awesome for leading the way. But they're still doing it for ego.

Discovering something new is fun and exciting. As an "explorer," it's normal to want to "timestamp" a discover. If Tesla is aware of the SSH access and Elon/Tesla isn't upset, let's move on?

 

[scaesare]

I won't lie, I didn't read this whole thread. The second I saw that someone at Tesla was trying to get into wk's car I prepared myself for the poop storm.

That being said, I'm sure we can all agree the best way to get back at Tesla is to make sure a flooded salvage car gets back on the road successfully.

That should really piss them off

Way to stick it to The Man!

 

[Andyw2100]

Most people reading this thread and/or posting in it have probably made up their mind by now on how they feel about wk057's initial tweet directed towards Tesla and Elon Musk. But there's some history here that I believe really comes into play. People seem split on whether the tweet was really inappropriate, how it could be taken the wrong way, etc., or whether it was made as a good-natured, well-intentioned joke. For this reason, I think the history is relevant.

Back in December of 2014, as many of us were awaiting the first deliveries of the Ds, and as some were finding their cars in the "Black Hole", Jason started sending Nerf missiles, with funny notes, to some people at Tesla, including Elon Musk:

I've expanded my Nerf missile shipments to include my DS and Elon Musk, as well as the original one to the factory. All orders included a nerf missle gun, enough Nerf ammo to bring down a small country, and a note along the lines of "Use these against those who are holding up the Ds!"

I also ordered a bunch of stuff for Toys for Tots while I was at it.

More recently, during the wait for the Auto Steer functionality within the Autopilot feature set to be released, Jason started a contest here on TMC to guess the release date, complete with a few hundred dollars worth of prizes, including a die-cast Tesla. Jason supplied all the prizes. He also tweeted Elon Musk about the contest, and invited him to enter:

@elonmusk You should enter, but might not really be fair... "The Autopilot Release Date Is Right!" http://goo.gl/TVTEG4 @TeslaMotors

My point is that while I acknowledge one might view Jason's tweet last week in a couple of different ways--the way it was intended, or in a more mean-spirited way--the positive, joking, nature of the history Jason had with his communications towards Elon Musk and Tesla would probably make it less ambiguous for those directly involved.

 

[okashira]

LOL. Wow, nice leak Mr. wk.
The sad thing is this is obvious and predictable. 100kwh pack will be "gigafactory," cells 20, 21 mm diameter and 70mm long. - new modules of course, but they will be based on the old design with some tweaks.
Not gonna bother reading the thread, but the OP is disturbing. Not surprising given how little support they give to people who want to repair their car.

 

[MikeBur]

... that Ethernet port is blocked using VLAN configuration and even before you needed to know enough to make your own custom connector and then ...

Can anyone point me to the post where this connector is described so I can build one please! Ironic though it is, my search-fu is weak today

 

[brianman]

... The Grep equivalent in windows would be known as "Search files and folders"...

We digress, but that's kind of like comparing Powershell to the X windows on top of Linux.

A better comparison would be "Windows Command Prompt" / "Windows Command Processor" combined with find or findstr.

- - - Updated - - -

Can anyone point me to the post where this connector is described so I can build one please! Ironic though it is, my search-fu is weak today

I'm not on the forums as much these days (and my memory isn't as good as it used to be) but my rough recollection is...
(1) There's an OBD port near the dead (left) foot pedal on the driver's side. This is there because of some regulations and Tesla doesn't really use it.
(2) The interesting, useful OBD port is at/near/in the back of the cubby under the 17" display.