Tesla's response to me leaking info about the P100D?

[wolrah]

I respectfully disagree. This is "plain text" only if you gain access to the secured system. It was included with the build not because Tesla didn't think it was a secret, but because they thought the system was secured. Maintaining separate codelines in order to prevent new feature information from entering the builds is time consuming, costly, and a source for issues (missed bug fixes while merging, reduced testing, etc).

I disagree with the assertion that the car qualifies as a "secured system". It's a general rule in computer security that if the attacker has unrestricted physical access to the system they'll be able to access any plaintext stored inside it. It is of course possible to design devices that self destruct (or at least destroy the keys used to secure sensitive data) when physically tampered with, but even that isn't foolproof. Look up the talk on "Shopshifting" from last year's Chaos Communication Congress, around 36:30 in they discuss how they bypassed the protections on the hardware security module in a payment terminal.

Anyways, interested enthusiasts digging through update files for hints about the future is a fact of life these days. Every time Google or Apple release an update for their phone platforms or one of their apps there's pretty much a race to see who can find any potential "leaks" first. Full desktop OSes have the same problem, if closely coupled with hardware (I know Mac OS X has inadvertently leaked details of future hardware, I think ChromeOS might have too). Same with game consoles, or even the games that run on them (see almost every Half-Life 3 rumor spawned by some assets in a /hl3/ directory in some Valve game). Tesla is full of intelligent people who in many cases came from the computer industry, I have a very hard time believing they aren't very aware of this.

You are of course correct about the build side. Unless things are *really* modular it can be really hard to keep bits and pieces of future features from making it in to bugfix releases of the older tree. It's not impossible, but how common this sort of update-mining is it's clear that a lot of major software vendors either don't care or haven't been able to do it.

 

[Doug_G]

Moved some posts to snippiness - probably others need to move too, but don't have time right now to track them down. Hopefully one of the section mods will come in and clean up the off topic stuff.

 

[Bangor Bob]

So at this point, if Tesla wants to keep surprises, they probably need to start putting in configuration items and artwork for "might never happen" products - P110D, P120D, P150D, P200D, P150Q, etc...

 

[wk057]

Moved some posts to snippiness - probably others need to move too, but don't have time right now to track them down. Hopefully one of the section mods will come in and clean up the off topic stuff.

Maybe I should revisit an old thread I made: Feature request: Self-moderated Threads

 

[dirkhh]

root@technicality:/mnt/2.13.77/usr/tesla/UI-2.13.77# find | grep badge
[SIZE=1][I]*snip*[/I][/SIZE]
./assets/ModelS/night/cluster/hi_res/[B]badge_p100d_ludicrous.png[/B]
[I][SIZE=1]*snip*[/SIZE]
[/I]

I mean, this isn't rocket science. Once you have access to the car this stuff is literally just laying right there. Anyone with any amount of Linux administration or dev knowledge would be able to see that a P100D was coming with access to their car's shell. This was not "software byte code" nor does it require "highly technical expertise to reverse engineer." Plaintext. Literally in plain sight. So don't try to make it out like I went out of my way to decode something in order to leak information.

Where did I put my *unsnip* tool...

You are right, Jason, finding those strings / png(s) really wasn't the hard part. But admittedly, getting that shell access is

 

[satoshi]

Your point before was that this was trivial and doesn't require technical expertise. You shared with us how to use grep without asking anyone to donate a Linux computer to you, so why not share how to get root shell access if it's just as trivial to do? Obviously you have no clue how to do this and your therefore your claim that it's easy to figure out is unsubstantiated, or you'd be able to articulate the how-to in a short paragraph that anyone without technical expertise can follow and get themselves root access.

You're being quite reckless all for the sake of an internet argument...

The linux systems on a model S are not identical to the linux systems you can download for free on the internet. There are substantial modifications they have made so it's a unique, and far less readily available system in that sense.

Whereas pure linux installations are in ample supply, have been around for over a decade, and are in wide-spread use... this means the ease of finding a youtube video wherein a 6 year old is using command line is not a problem.

The model S is not in ample supply, is not free by any means, and also there are legal matters to consider... did you conveniently forget to read this bit?:

Now, there's another issue even if you do provide financial support... terms of the bug bounty program limit how much information I can legally publish publicly anyway. Then also, winning an internet argument isn't really that important to top it off. I'm most motivated by what promotes the acceleration of sustainable transportation solutions (which coincidentally is Tesla's mission statement, but I've held this statement of purpose long before Tesla was founded), and if your internet argument was found to be an ethical conflict I would drop it and accept looking like a fool any day.

I know how to do it already, but what I am not confident of what collateral damage I might do by explaining it. Thus, I need a model S in hand to verify that I'm not accidentally exposing something else in their system by the explanation.

While it is easy to digest and perform, it is still very sensitive material we are dealing with here and posting it all over the internet as recklessly as you are suggesting is unethical and something to expect out of a black hat.

 

[whitex]

I disagree with the assertion that the car qualifies as a "secured system". It's a general rule in computer security that if the attacker has unrestricted physical access to the system they'll be able to access any plaintext stored inside it. It is of course possible to design devices that self destruct (or at least destroy the keys used to secure sensitive data) when physically tampered with, but even that isn't foolproof.

If nothing is foolproof (which I agree with), therefore by your argument nothing ever qualifies as a "secured system" if user has physical access? If a vendor places an ATM machine inside a private business (a store, night club, or a casino) is that not considered secured system? Does that business have the right to empty that cash machine?

By the way, I suspect future automotive solutions will finally embrace the complete system encryption where all off-chip communications are encrypted, which includes all communications, DRAM, and EMMC/flash. Chips today already support such features, it's just that companies are reluctant to use them because they add cost by having to develop the software, having to provision such secure systems (key provisioning and such), developers and testers hate them (much harder to work with and debug such systems). In automotive, the only remaining challenge for this today is legacy devices on the CAN buses. Are such systems unhackable? No, but the level of difficulty to get to the information goes up VERY significantly (you can Xray running chips to try to extract keys, or try to figure things out from noise emissions - all doable but a completely different level of hacking).

The Jeep hackers helped bring attention to safety-security in the automotive sector. Prior to that, cyber security was seen as an unnecessary cost because the majority of customers will not pay extra for better secured cars because they don't care. They will blame the manufacturer if the car gets hacked, but if you offer them a $2000 security package with a smart firewall for their connected car, they will not pay. Same if you make the car more expensive than the competitor, "this car's connectivity is more secure" is not worth a lot of dollars in customers eyes (sadly). Events such as this "P100D" leak will help the engineering management to justify the cost of complete system encryption.

 

[feli]

You mean wk057's car? Lots of people wouldn't mind having it. Me, for one. :wink:

i was assuming that hacking the car voids your warranty. Is that the case ? equipment manufacturers have the right to enforce that, as the modification of the firmware/software could potentially have implications on the hardware itself.

A hypothetical example: If i hack the firmware to get faster charging (which is possible by the way), so i can charge the batteries at 20C (C=capacity in Wh) not talking about temps. The batteries will charge faster eventually, depends on the chemistry and the specs of a particular battery. But in the end the lifetime of the battery will take a hit. When tesla designed the car they made those compromises on how fast you could supercharge, etc. So if you go there and change that firmware, you are impacting the hardware. Another example, autopilot. You could make changes and change the rules, like say, disable the "put your hands on the wheel" sign and requirement.

So rooting the system opens the door to all those implications, so they may have the right to terminate your warranty as the specifications and functionality of the system could be compromised, not by even the original hacker, but by some others that unknown to the original hacker could get access and make changes in the OS/SW/FW of the car. So in that case tesla could void your warranty. If they do this with phones, computers, etc, why would this case be any different ?

 

[Naonak]

Please tell me which system's security depend on the salt being secret, rather than it being unique, and I'll be sure to stop visiting it!

The purpose of a salt in a password is to protect against a rainbow table attack by effectively requiring a different rainbow table for each user in the system, which would defeat the purpose. If you use the same salt for every user, if the salt is ever determined, you'll be able to once again create a common rainbow table to give you every password in the system.


In general, any security solution that relies on "as long as x stays secret" is broken from the get go.

Well, we'll see you around then. This forum as well as most others use a static salt. I haven't looked at the source code in a good long while, so maybe they've fixed that in at least some of the OSS packages, along with vB and it's kin. That is, unless this forum isn't actually a VB forum but only looks like one? A static salt defeats a rainbow table as well, since each forum has a unique salt... you'd have to generate a rainbow table for each one, and generating huge rainbow tables takes a lot of time and space... almost as much as brute forcing individual salted hashes, especially if you're targeting specific accounts.

The point of a rainbow table is that you only have to generate it once for uses in many places. If you have to generate a new rainbow table for every forum, their purpose is much more limited. But I agree, it's definitely not the right way to do things.

 

[qwk]

Maybe they could, while they're doing this:
(a) start complying with the software licenses for things like Linux, which is very generous, rather than pirating and selling them for profit, which is what Tesla has been doing for the last 3 years. The copyright owners will probably be forgiving if Tesla straightens up and flies right.
(b) come up with a quality control procedure to prevent regressions from being released

- - - Updated - - -



You're just wrong about this, Bonnie. But let's take your point of view seriously. As if you actually believed it.

Tesla is a proven and admitted software pirate. They've pirated Linux, which is made by a large number of programmers who issue it under a very specific license for very specific financial reasons which relate to the value of their reputations and the value of receiving back any modifications. Tesla's just ignored that license and pirated Linux. Based on *your* belief system, bonnie (not mine!), Tesla are BIG THIEVES. Right? I'm just pointing out that you ought to think a little harder about what you believe. (I actually just believe Tesla has been sloppy and rude and copyright-infringing. I would never call it theft.)

"It's ok because Tesla is a startup". Lol
I'm really surprised nobody's posted that excuse yet...

 

[apacheguy]

i was assuming that hacking the car voids your warranty. Is that the case ?

Apple voids the warranty if you bring in a jail broken iPhone. Not sure why Tesla has been so lenient.

 

[wk057]

Hacking the car does not void the warranty. At least in the United States it legally can not be voided by owner modifications unless the manufacturer can prove that those modifications were a direct cause of failure for of a warrantied part. In my case there is no way that this is a warranty issue, legally speaking. If something breaks on the car that's under warranty Tesla would have a hard time proving that my having root on the car caused anything to fail.

- - - Updated - - -

Apple voids the warranty if you bring in a jail broken iPhone. Not sure why Tesla has been so lenient.

They have to be, it's the law.

 

[apacheguy]

Which law under what clause is this?

What about the sticker on my router that states "Warranty void if seal broken"?

 

[whitex]

Tesla is a proven and admitted software pirate. They've pirated Linux, which is made by a large number of programmers who issue it under a very specific license for very specific financial reasons which relate to the value of their reputations and the value of receiving back any modifications. Tesla's just ignored that license and pirated Linux.

Wow, I obviously missed something along the way. neroden, catch up please? Can you point to the alleged admission of piracy?

 

[Canuck]

Tesla is a proven and admitted software pirate. They've pirated Linux, which is made by a large number of programmers who issue it under a very specific license for very specific financial reasons which relate to the value of their reputations and the value of receiving back any modifications. Tesla's just ignored that license and pirated Linux.

Can you please post the "very specific licence" that you say Tesla has breached? I googled the licence agreement and found this:

http://www.redhat.com/f/pdf/licenses/GLOBAL_EULA_RHEL_English_20101110.pdf

And this:

Is Linux Free For Business use???

http://wiki.linuxquestions.org/wiki/Common_Questions_and_Misconceptions#Q:_Is_Linux_really_available_for_zero_cost.3F

I also googled "Tesla pirated Linux" and the first cite, and the only one with all three search terms, was your post above. I would think Linux would take action if Tesla was using their software illegally as you suggest.

 

[dirkhh]

Not again. There are many threads about this already somewhere. Here's one Tesla, Linux and the GPL

tl;dr: the GPLv2 under which the Linux kernel is published requires that if you distribute a binary build of the kernel (as Tesla does when selling you a car) you have to offer in writing a way to the recipient to get the modified sources of any software included that is under the GPL.

Tesla has been asked to provide their patches to Linux (and Qt) and has not done so in clear violation of that license.

Now, interestingly, that is NOT the same thing as theft. They have not stolen Linux from us, the developers. They are "just" in violation of the terms of our license.

 

[Xminus6]

Which law under what clause is this?

What about the sticker on my router that states "Warranty void if seal broken"?

Magnuson–Moss Warranty Act - Wikipedia, the free encyclopedia

 

[darthy001]

Not again. There are many threads about this already somewhere. Here's one Tesla, Linux and the GPL

tl;dr: the GPLv2 under which the Linux kernel is published requires that if you distribute a binary build of the kernel (as Tesla does when selling you a car) you have to offer in writing a way to the recipient to get the modified sources of any software included that is under the GPL.

Tesla has been asked to provide their patches to Linux (and Qt) and has not done so in clear violation of that license.

Now, interestingly, that is NOT the same thing as theft. They have not stolen Linux from us, the developers. They are "just" in violation of the terms of our license.

Dont think it can be repeated enought times in a thread where people attack wk057, among other angles of attack, for breaking Tesla licenses etc when Tesla themselves obviously dont really care about license-terms for the open source software they choose to use in their cars.

Especially when some of the same people in the same thread compare copying a piece of software with actual physical theft. In my world the license under which software is released determines the rights of anyone else to use it. Why is not complying with those rights not theft if you believe copying software is theft in the first place? For the record I dont personally believe this is ever theft and I have worked in the software business all of my life.... I just get really irritated about a group of users here who sees everything wk057 does through the worst possible light, but at the same time ignore all wrongdoings of Tesla in the same field.

Simply linking to another thread they obviously ignore doesnt cut it in terms of getting the message across. Seeing the way these post by myself are completely ignored and nerodens scuffed of due to past differences just proves that this is information that is highly relevant in such a thread.

 

[Canuck]

I simply asked for someone to please post the Linux licence that Tesla supposedly breached.

I don't see the licence in this thread (and I read every post and clicked on every link):

Not again. There are many threads about this already somewhere. Here's one Tesla, Linux and the GPL

And this link is to legislation -- not the licence agreement -- and we don't even get to legislation until we can find a breach of an agreement:

Magnuson–Moss Warranty Act - Wikipedia, the free encyclopedia

Please don't get me wrong. I'm not saying Tesla didn't breach the "very specific license". I'm just asking for a link to it -- that's all. That should be easy to direct me to. Once again, I googled the Linux licence agreement and found this:

http://www.redhat.com/f/pdf/licenses...h_20101110.pdf

Tesla did not breach this agreement.

Tesla is a proven and admitted software pirate. They've pirated Linux, which is made by a large number of programmers who issue it under a very specific license...

Certainly, after making that statement someone should be able to point me this "very specific license". I would also like the source material for the statement that Tesla is an "admitted software pirate" but something tells me there is no source to that allegation. So we'll start with a very simple reference to the licence agreement breach - no other commentary is needed and will likely only cloud this very specific issue.

It also seems to me that if Tesla had breached the licence agreement, the copyright holders would take them to task, rather than random people in this thread, but I could find no such legal action, which is another reason I'd just like to see the clause in the licence agreement Tesla allegedly breached.

Edit: In researching this issue some more, the answer appears to lie in the GPL lawsuit involving TomTom/Linux/Microsoft and, in particular, Microsoft's anti-GPL offensive about whether the GPL is enforceable at all. I can now see why Linux and its copyright holders have not, and likely will not, take action against Tesla.

I also think it's reckless (and worse) to call Tesla a pirate and other derogatory names regarding its use of Linux. I'm quite certain Tesla has lawyers who review their use of all software and its governing agreements, and then Tesla acts on legal advice regarding the use of the software, paying fees where required by law.

Pirates act outside of the law and thus don't seek legal advice.

 

[fren]

nothing much difficult for who knows unix in general but always interesting to see what s happening inside the beast