8 ms·

Tesla Model S Ethernet Network Explored

183 points by tty 12y ago

lelf 12y ago
Source: http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network http://www.teslamotorsclub.com/showthread.php/28185-Successf...
zw123456 12y ago
Someone should post some wireshark pcaps.
csense 12y ago
How can the car communicate with the Internet? Does it have a cell modem or something? Is a lifetime subscription included in the purchase price of the vehicle, or does the user get a monthly bill? Wouldn't a real industrial espionage operation disconnect or Faraday cage the vehicle's remote communications capability as their very first step? If you were trying to reverse engineer Tesla's secrets, would you really care about voiding the warranty?
rrouse 12y ago
Interesting that it phoned home
mitchellh 12y ago
The cool things: Tesla is running Linux (!) and standard technologies/protocols such as SSH, NFS, X11, HTTP, etc. to do things in the car. That is cool, and probably highly efficient since developer test labs can probably just be basic Ubuntu-like virtual machines. The sketchy things: Jailbreaking a car seems pretty dangerous, especially since as far as I'm aware, the electronic systems control things including the brake. I know this only because Tesla recently released a software update that added "hill assist" which will hold the brake in place for 1 second when at a certain incline to avoid rolling back. Imagine a malicious software update that disabled the brake! Personally, I would jailbreak a phone, but not a car. :) HOPEFULLY the system the ethernet port provides access to is firewalled out of being able to update any software (i.e. the software update mechanism is some other device), but who knows. The phone home can also be considered sketchy, but any Tesla owner is well aware the car pings home and relays diagnostic data to Tesla. At the very least, Tesla owners know it must ping home to check for updates periodically. If anything, I thought it was kind of cool that Tesla engineers detected it and reached out so quickly. Imagine if you weren't tampering with your car and it WAS a high-tech attacker. It is good to know that they can detect the basics.
- jcdavis 12y ago
  No way is the drive control software is running linux, its almost certainly running on its own embedded system.
  - XorNot 12y ago
    Depends what level we're talking about surely? SpaceX have their own real time Linux which they do use on rocket systems - stands to reason they might bring a similar idea over to automotive systems.
  - mitchellh 12y ago
    Absolutely, I agree, but the software update mechanism is somehow able to update or interface with that system. If you're able to jailbreak _that_, then its one less barrier in the way of taking over the drive control.
    - viraptor 12y ago
      I'm sure only signed updates are allowed. Same as with intel microcode updates and most firmwares. They'd be highly irresponsible if jailbreaking was left possible.
      - mikeash 12y ago
        Lots of systems are built to only allow signed updates, but bugs often allow bypassing that. If you can exploit the existing firmware, you can effectively load new ones. That's how iOS jailbreaks work despite Apple's attempt to only allow booting an Apple signed OS.
      - jamesaguilar 12y ago
        Nobody intends jailbreaks to be possible. It's done through exploiting bugs. And saying it'd be highly irresponsible to write a bug is like saying it'd be irresponsible to use the bathroom. It may stink, but everyone does it.
driverdan 12y ago
“Tesla USA engineers have seen a tentative of hacking on my car.”, “can be related to industrial espionage and advised me to stop investigation, to not void the warranty”. So long as you don't cause any damage they can't void your warranty in the US thanks to the Magnuson–Moss Warranty Act.
- eridius 12y ago
  Poking around an unknown device's network and sending arbitrary commands to see how it responds could certainly very well damage something.
  - threeseed 12y ago
    So could poking around the physical components of the car. But people are well within the right to do so.
  - Maxious 12y ago
    On page 53 of the "Adventures in Automotive Network and Control Units" paper there's a photo of what happened to the researchers garage after a command to run diagnostics on the brakes left the vehicle unable to stop even at slow speeds http://illmatics.com/car_hacking.pdf http://illmatics.com/car_hacking.pdf
- jnbiche 12y ago
  And that's a mighty hacker-unfriendly stance to take for a company whose client base is made up of a disproportionately large number of engineers and computer scientists, many of whom will doubtless be curious as to the inner workings of their car computer systems. I mean, could you imagine if a car manufacturer took this attitude toward car owners who were exploring the car's transmission, which is clearly just as critical to the car's safety as the car computer system? My view of Tesla just sank a notch (but I still want one). Edit: Actually, I thought about it a bit, and I actually don't want one anymore if this is the attitude that prevails inside the company. For the same reason that I don't want any Apple products. I'm far from a Stallman acolyte, but I'll be damned if I'll buy from a company that wants to forbid me from hacking on hardware that I have purchased and own.
afhsfsfdsss88 12y ago
As a hacker...Cool! As a driver who will have to occupy space around people playing with this while driving...F#&*!
- chris_mahan 12y ago
  Agreed. There should be a large warning on the console: "Warning to passengers: The Vehicle Systems have been Compromised. Please do not ride in this vehicle. A Service tow truck has been dispatched." Also, the car should not move.
  - lvs 12y ago
    Do you think the same thing about a car where the owner has, say, installed aftermarket brake calipers and suspension components? ... Because that's incredibly common.
  - jnbiche 12y ago
    Wow, as someone who grew up "hacking" on my car (i.e., on the engine) this attitude is pretty amazing. What a dangerous, mysterious thing a car must seem to you.
    - CamperBob2 12y ago
      I can see both sides of this one. If I R&R my brakes or repair the steering rack, I can reasonably claim that I did so using good mechanical skills and practices, and prove it in court if necessary. But if I tinker around with a closed-source software system in my car, I literally have no idea what I'm doing. The changes I'm making could affect any and every other system on the car... and nobody but the factory engineers would know for sure. The best solution is the simplest: no closed-source systems allowed in cars used on public roads. But I wouldn't hold my breath until everyone gets on board with that.
    - chris_mahan 12y ago
      I've done plenty to cars. Have done plenty with computers too. I wouldn't let my family and friend ride in a car with compromized safety systems.
mschuster91 12y ago
A quick google for the source code only revealed http://www.teslamotorsclub.com/archive/index.php/t-10748.html http://www.teslamotorsclub.com/archive/index.php/t-10748.htm... - apparently Tesla has never released the source code of the "modified Ubuntu" they're using. Whoops. Also, looks like Tesla has got international deals with mobile carriers for data flatrates. I'm looking forward to see the first guy stream youtube or youp*rn on the dashboard :D
- nandhp 12y ago
  Moreover, it's my understanding that if there's any GPLv3 software on the Tesla, you have the right to receive installation instructions that allow you to install a modified version of that software on your Tesla. But Tesla is not required to honor the warranty of Teslas whose software has been modified. I wonder if they ship coreutils?
- eik3_de 12y ago
  If they don't modify gpl code but just configure existing software and add their own packages, do they still have to pub everything?
  - mschuster91 12y ago
    Yes, you at least have to say where to get the source from if you publish/distribute binaries to others.
    - eik3_de 12y ago
      but only if their binary is linked against a gpl library..?
      - catern 12y ago
        They're shipping Linux. There's certainly plenty of GPL binaries in their system.
      - mschuster91 12y ago
jwise0 12y ago
The original thread that this came from: http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network http://www.teslamotorsclub.com/showthread.php/28185-Successf... Interesting in particular is one poster's claim that Tesla gave him a seemingly-dismayed call... http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network/page12?p=610152&viewfull=1#post610152 http://www.teslamotorsclub.com/showthread.php/28185-Successf...
dm2 12y ago
Can Tesla detect if settings or the files for one of their cars are modified? I would like an option to contact home base to verify that all files and configurations in my car are exactly like their suppose to be, else either disable the car or download the correct software. Maybe a way to enable a developer mode which can only be used on a non-public road. I just can't imagine modifying an electric vehicles computers and settings for anything useful. Please offer some suggestions if you can.
- DasIch 12y ago
  In Germany you have to get your car checked every two years by the "TÜV", if it passes you get a sticker for the license plate without which you are not allowed to drive the car. Given how critical the software already is, I would be surprised if there isn't a system already in place, that car companies are required to put in, that can use to verify the software for any car.
- deevus 12y ago
  Nice. A bit like Steam's verify game cache.
- hamiltonkibbe 12y ago
  I could certainly see people modifying cotor controller settings. Changing hard RPM limits, or tuning PID controller gains for extra milliseconds on the track.
  - dm2 12y ago
    I doubt there is too much that can be done to increase the performance. Removing seats seems like it would be more effective than messing with RPM limits. http://www.teslamotorsclub.com/attachment.php?attachmentid=2755&d=1317483193 http://www.teslamotorsclub.com/attachment.php?attachmentid=2... I just don't think it's worth compromising safety and implementing more systems (to regular where the modified cars are driven) to satisfy the small percentage of people who want to use a Model S as a serious track car. It's already pretty competitive on the track https://www.youtube.com/watch?v=VLCdP6sMN9k https://www.youtube.com/watch?v=VLCdP6sMN9k One wreck from a modified Model S would be disastrous for Tesla, it's just not worth it at this point in my opinion.
AceJohnny2 12y ago
I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems. Automotive systems communicate over a CAN [1] bus, not ethernet. In fact, this bus is usually physically separated between drive-critical bus (which controls things like ABS) and "comfort" bus (such as electric window controls, central door locks, wheel-mounted audio controls). Ethernet has none of the industrial strength qualities that make CAN a valid automotive control bus, such as signal hardening and real-time guarantees. As far as these users have found, this ethernet port is connected to the infotainment system: the 17" display. I would be deeply disappointed in Tesla if the infotainment system can modify drive-control devices with anything less than signed binaries and commands. As an aside, I wonder what the legal requirements of such safeties are. [1] http://en.wikipedia.org/wiki/CAN_bus http://en.wikipedia.org/wiki/CAN_bus
- miah_ 12y ago
  Super interesting. There was this hack from a few months ago that involved messing with items on the CAN bus. I think they get into more of the details; https://www.youtube.com/watch?v=oqe6S6m73Zw https://www.youtube.com/watch?v=oqe6S6m73Zw
- kalleboo 12y ago
  What about cars where you can enable/disable features like traction control and auto-break from the entertainment system? They must have some sort of connection, and that connection probably has bugs that could be exploited.
- threeseed 12y ago
  I guess the point is that signed binaries aren't full proof. Look at how jail breakers have been able to continually defeat the iOS security controls over the years. And surely Apple has a larger and more experienced development team than Tesla.
  - the_ancient 12y ago
    Why would you believe that? Apple is mainly a Design firm, they are good at making things look pretty... not much else..
Theodores 12y ago
Onto more important matters, does anyone know the track being played? The title is 'All the things she said', which originally was a #1 Top 40 song by the Russian pop group 'Tatu'. However the picture is definitely not the Russian duo. Is this a German cover version of some sort?
- nemo1618 12y ago
  I tried reverse image searching the photo, but got nothing. However, a simple YouTube search for the song name turned up a bunch of cover versions. This one matches the length shown (4:17): https://www.youtube.com/watch?v=tytPcvyJASc https://www.youtube.com/watch?v=tytPcvyJASc The band, Simple Plan, also appears to have five members, which is pretty strong supporting evidence. Strangely, I couldn't find the exact image shown in the Tesla photo.
scotty79 12y ago
So, inspecting a product you own is industrial espionage now?

183 points by tty 12y ago

lelf 12y ago

Source: http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network http://www.teslamotorsclub.com/showthread.php/28185-Successf...

zw123456 12y ago

Someone should post some wireshark pcaps.

csense 12y ago

How can the car communicate with the Internet? Does it have a cell modem or something? Is a lifetime subscription included in the purchase price of the vehicle, or does the user get a monthly bill? Wouldn't a real industrial espionage operation disconnect or Faraday cage the vehicle's remote communications capability as their very first step? If you were trying to reverse engineer Tesla's secrets, would you really care about voiding the warranty?

rrouse 12y ago

Interesting that it phoned home

mitchellh 12y ago

The cool things: Tesla is running Linux (!) and standard technologies/protocols such as SSH, NFS, X11, HTTP, etc. to do things in the car. That is cool, and probably highly efficient since developer test labs can probably just be basic Ubuntu-like virtual machines. The sketchy things: Jailbreaking a car seems pretty dangerous, especially since as far as I'm aware, the electronic systems control things including the brake. I know this only because Tesla recently released a software update that added "hill assist" which will hold the brake in place for 1 second when at a certain incline to avoid rolling back. Imagine a malicious software update that disabled the brake! Personally, I would jailbreak a phone, but not a car. :) HOPEFULLY the system the ethernet port provides access to is firewalled out of being able to update any software (i.e. the software update mechanism is some other device), but who knows. The phone home can also be considered sketchy, but any Tesla owner is well aware the car pings home and relays diagnostic data to Tesla. At the very least, Tesla owners know it must ping home to check for updates periodically. If anything, I thought it was kind of cool that Tesla engineers detected it and reached out so quickly. Imagine if you weren't tampering with your car and it WAS a high-tech attacker. It is good to know that they can detect the basics.

jcdavis 12y ago
No way is the drive control software is running linux, its almost certainly running on its own embedded system.
- XorNot 12y ago
  Depends what level we're talking about surely? SpaceX have their own real time Linux which they do use on rocket systems - stands to reason they might bring a similar idea over to automotive systems.
- mitchellh 12y ago
  Absolutely, I agree, but the software update mechanism is somehow able to update or interface with that system. If you're able to jailbreak _that_, then its one less barrier in the way of taking over the drive control.
  - viraptor 12y ago
    I'm sure only signed updates are allowed. Same as with intel microcode updates and most firmwares. They'd be highly irresponsible if jailbreaking was left possible.
    - mikeash 12y ago
      Lots of systems are built to only allow signed updates, but bugs often allow bypassing that. If you can exploit the existing firmware, you can effectively load new ones. That's how iOS jailbreaks work despite Apple's attempt to only allow booting an Apple signed OS.
    - jamesaguilar 12y ago
      Nobody intends jailbreaks to be possible. It's done through exploiting bugs. And saying it'd be highly irresponsible to write a bug is like saying it'd be irresponsible to use the bathroom. It may stink, but everyone does it.

driverdan 12y ago

“Tesla USA engineers have seen a tentative of hacking on my car.”, “can be related to industrial espionage and advised me to stop investigation, to not void the warranty”. So long as you don't cause any damage they can't void your warranty in the US thanks to the Magnuson–Moss Warranty Act.

eridius 12y ago
Poking around an unknown device's network and sending arbitrary commands to see how it responds could certainly very well damage something.
- threeseed 12y ago
  So could poking around the physical components of the car. But people are well within the right to do so.
- Maxious 12y ago
  On page 53 of the "Adventures in Automotive Network and Control Units" paper there's a photo of what happened to the researchers garage after a command to run diagnostics on the brakes left the vehicle unable to stop even at slow speeds http://illmatics.com/car_hacking.pdf http://illmatics.com/car_hacking.pdf
jnbiche 12y ago
And that's a mighty hacker-unfriendly stance to take for a company whose client base is made up of a disproportionately large number of engineers and computer scientists, many of whom will doubtless be curious as to the inner workings of their car computer systems. I mean, could you imagine if a car manufacturer took this attitude toward car owners who were exploring the car's transmission, which is clearly just as critical to the car's safety as the car computer system? My view of Tesla just sank a notch (but I still want one). Edit: Actually, I thought about it a bit, and I actually don't want one anymore if this is the attitude that prevails inside the company. For the same reason that I don't want any Apple products. I'm far from a Stallman acolyte, but I'll be damned if I'll buy from a company that wants to forbid me from hacking on hardware that I have purchased and own.

afhsfsfdsss88 12y ago

As a hacker...Cool! As a driver who will have to occupy space around people playing with this while driving...F#&*!

chris_mahan 12y ago
Agreed. There should be a large warning on the console: "Warning to passengers: The Vehicle Systems have been Compromised. Please do not ride in this vehicle. A Service tow truck has been dispatched." Also, the car should not move.
- lvs 12y ago
  Do you think the same thing about a car where the owner has, say, installed aftermarket brake calipers and suspension components? ... Because that's incredibly common.
- jnbiche 12y ago
  Wow, as someone who grew up "hacking" on my car (i.e., on the engine) this attitude is pretty amazing. What a dangerous, mysterious thing a car must seem to you.
  - CamperBob2 12y ago
    I can see both sides of this one. If I R&R my brakes or repair the steering rack, I can reasonably claim that I did so using good mechanical skills and practices, and prove it in court if necessary. But if I tinker around with a closed-source software system in my car, I literally have no idea what I'm doing. The changes I'm making could affect any and every other system on the car... and nobody but the factory engineers would know for sure. The best solution is the simplest: no closed-source systems allowed in cars used on public roads. But I wouldn't hold my breath until everyone gets on board with that.
  - chris_mahan 12y ago
    I've done plenty to cars. Have done plenty with computers too. I wouldn't let my family and friend ride in a car with compromized safety systems.

mschuster91 12y ago

A quick google for the source code only revealed http://www.teslamotorsclub.com/archive/index.php/t-10748.html http://www.teslamotorsclub.com/archive/index.php/t-10748.htm... - apparently Tesla has never released the source code of the "modified Ubuntu" they're using. Whoops. Also, looks like Tesla has got international deals with mobile carriers for data flatrates. I'm looking forward to see the first guy stream youtube or youp*rn on the dashboard :D

nandhp 12y ago
Moreover, it's my understanding that if there's any GPLv3 software on the Tesla, you have the right to receive installation instructions that allow you to install a modified version of that software on your Tesla. But Tesla is not required to honor the warranty of Teslas whose software has been modified. I wonder if they ship coreutils?
eik3_de 12y ago
If they don't modify gpl code but just configure existing software and add their own packages, do they still have to pub everything?
- mschuster91 12y ago
  Yes, you at least have to say where to get the source from if you publish/distribute binaries to others.
  - eik3_de 12y ago
    but only if their binary is linked against a gpl library..?
    - catern 12y ago
      They're shipping Linux. There's certainly plenty of GPL binaries in their system.
    - mschuster91 12y ago

jwise0 12y ago

The original thread that this came from: http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network http://www.teslamotorsclub.com/showthread.php/28185-Successf... Interesting in particular is one poster's claim that Tesla gave him a seemingly-dismayed call... http://www.teslamotorsclub.com/showthread.php/28185-Successful-connection-on-the-Model-S-internal-Ethernet-network/page12?p=610152&viewfull=1#post610152 http://www.teslamotorsclub.com/showthread.php/28185-Successf...

dm2 12y ago

Can Tesla detect if settings or the files for one of their cars are modified? I would like an option to contact home base to verify that all files and configurations in my car are exactly like their suppose to be, else either disable the car or download the correct software. Maybe a way to enable a developer mode which can only be used on a non-public road. I just can't imagine modifying an electric vehicles computers and settings for anything useful. Please offer some suggestions if you can.

DasIch 12y ago
In Germany you have to get your car checked every two years by the "TÜV", if it passes you get a sticker for the license plate without which you are not allowed to drive the car. Given how critical the software already is, I would be surprised if there isn't a system already in place, that car companies are required to put in, that can use to verify the software for any car.
deevus 12y ago
Nice. A bit like Steam's verify game cache.
hamiltonkibbe 12y ago
I could certainly see people modifying cotor controller settings. Changing hard RPM limits, or tuning PID controller gains for extra milliseconds on the track.
- dm2 12y ago
  I doubt there is too much that can be done to increase the performance. Removing seats seems like it would be more effective than messing with RPM limits. http://www.teslamotorsclub.com/attachment.php?attachmentid=2755&d=1317483193 http://www.teslamotorsclub.com/attachment.php?attachmentid=2... I just don't think it's worth compromising safety and implementing more systems (to regular where the modified cars are driven) to satisfy the small percentage of people who want to use a Model S as a serious track car. It's already pretty competitive on the track https://www.youtube.com/watch?v=VLCdP6sMN9k https://www.youtube.com/watch?v=VLCdP6sMN9k One wreck from a modified Model S would be disastrous for Tesla, it's just not worth it at this point in my opinion.

AceJohnny2 12y ago

I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems. Automotive systems communicate over a CAN [1] bus, not ethernet. In fact, this bus is usually physically separated between drive-critical bus (which controls things like ABS) and "comfort" bus (such as electric window controls, central door locks, wheel-mounted audio controls). Ethernet has none of the industrial strength qualities that make CAN a valid automotive control bus, such as signal hardening and real-time guarantees. As far as these users have found, this ethernet port is connected to the infotainment system: the 17" display. I would be deeply disappointed in Tesla if the infotainment system can modify drive-control devices with anything less than signed binaries and commands. As an aside, I wonder what the legal requirements of such safeties are. [1] http://en.wikipedia.org/wiki/CAN_bus http://en.wikipedia.org/wiki/CAN_bus

miah_ 12y ago
Super interesting. There was this hack from a few months ago that involved messing with items on the CAN bus. I think they get into more of the details; https://www.youtube.com/watch?v=oqe6S6m73Zw https://www.youtube.com/watch?v=oqe6S6m73Zw
kalleboo 12y ago
What about cars where you can enable/disable features like traction control and auto-break from the entertainment system? They must have some sort of connection, and that connection probably has bugs that could be exploited.
threeseed 12y ago
I guess the point is that signed binaries aren't full proof. Look at how jail breakers have been able to continually defeat the iOS security controls over the years. And surely Apple has a larger and more experienced development team than Tesla.
- the_ancient 12y ago
  Why would you believe that? Apple is mainly a Design firm, they are good at making things look pretty... not much else..

Theodores 12y ago

Onto more important matters, does anyone know the track being played? The title is 'All the things she said', which originally was a #1 Top 40 song by the Russian pop group 'Tatu'. However the picture is definitely not the Russian duo. Is this a German cover version of some sort?

nemo1618 12y ago
I tried reverse image searching the photo, but got nothing. However, a simple YouTube search for the song name turned up a bunch of cover versions. This one matches the length shown (4:17): https://www.youtube.com/watch?v=tytPcvyJASc https://www.youtube.com/watch?v=tytPcvyJASc The band, Simple Plan, also appears to have five members, which is pretty strong supporting evidence. Strangely, I couldn't find the exact image shown in the Tesla photo.

scotty79 12y ago

So, inspecting a product you own is industrial espionage now?