Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet

https://www.synacktiv.com/en/publications/exploiting-the-tesla-wall-connector-from-its-charge-port-connector-part-2-bypassing

by p_stuart82 • 2 months ago

136 78 2 months ago

synacktiv.com

486sx33• 2 months ago

Why would I want to hack the bootloader for a wall charger? Asking for a friend

culi2• 2 months ago

You can bypass vehicle restrictions. You could potentially then use it for J1772-compatible EVs (like a Chevy Bolt or Nissan Leaf)

Or just for the spirit of actually owning the shit you pay for.

m4633• 2 months ago

I don't think there are any restrictions. I think j1772 might just work with an adapter (adapt from the nacs plug to the j1772 plug)

I thought tesla even made a j1772 native wall connector.

decimalenough• 2 months ago

What vehicle restrictions? This is for the Tesla home charger, not Superchargers.

NewJazz• 2 months ago

Implement your own payment provider

fc417fc802• 2 months ago

To play doom on it?

kotaKat• 2 months ago

Publicly accessible piece of equipment that could have a pseudo-trusted connection to an internal network (since they're connected to the Tesla Cloud(tm)).

Picturing someone rolling up to a charger outside of a large office building, 'plugging in', exploiting the charger via the communications, then using the charger to pivot inwards.

m4633• 2 months ago

I hate the gen 3 wall connector.

It creates a wifi access point in your garage that you cannot turn off:

  TeslaWallConnector_<unique-id>

some people were able to downgrade their firmware to a version that didn't do that, but i guess this article shows telsa got rid of that ability.

I would love to be able to hack any firmware to disable that.

I also read that a connected tesla car can force an over-the-air firmware update maybe through the charging cable or wifi, but I haven't verified that.

iugtmkbdfil834• 2 months ago

Thank you. This information is not listed anywhere and I am currently getting quotes for solar panel build.

ralph842• 2 months ago

The SSID stops broadcasting after the unit is commissioned, unless you're using power sharing between multiple units. In that case the SSID is used for the units to communicate.

m4633• 2 months ago

by commissioned you mean "connect it to your home wifi and let it talk to tesla"? (i won't do that)

because it hasn't gone away after configuring the setup stuff (amps, etc)

jp1919193• 2 months ago

I put mine on an isolated IOT network.

mystraline• 2 months ago

Repeat after me:

An owner voluntarily downgrading firmware to gain control of your hardware IS NOT A HACK.

And if an adversary is doing this, then they have already breached yoir physical security.

kube-system2• 2 months ago

Eh, that’s a bad generalization. defense in depth is a thing and there are many cases where you’d want to protect against attackers with physical access

AlotOfReading• 2 months ago

Any system where your defense in depth involves UDS is pretty much guaranteed to be broken though.

zelon882• 2 months ago

This isn't designed to stop attackers with physical access. This is designed to stop casual tinkerers and shade tree mechanics.

You know what isn't vulnerable? A "dumb" offline charger. You know what doesn't make any money or turn the consumer into another product? A "dumb" offline charger.

If it were about physical security, the suggested fix would be to remove the communication from the port entirely.

Companies shouldn't get to make something simple and secure into something inherently insecure and then iterate security into it. Like drive by wire steering, or brakes. Nobody asked for these things and if you ask ANYONE who works on, builds, or actually enjoys cars the consensus is NOBODY wants it.

But there are enough sophomoric, pedestrian car owners out there who gawk at the senseless overdeployment of technology and think "this is so convinient" and don't see it as 1) regulatory barrier building and gatekeeping 2) enabling vendor lock in 3) overcoming right to repair legislation. So the knowledgeable and enthusiastic voices of reason who care about cars get drowned out by the hoard of pedestrian geeks who couldn't imagine operating a car without at least a 16 inch touchscreen.

In security, the best defense is not introducing a vulnerability at all. There is value in having less code. For example, if your PaaS doesn't collect user SSNs... then it can't lose SSNs in a breach.

The question here should not be "why is this not secure." The question should be "why does this even need to be secure in the first place?" We have a very simple task to do and we've complicated it so much we've introduced vulnerability that didn't exist previously.

taneq• 2 months ago

Arguably it’s a crack. A good one, though.

pram• 2 months ago

They shouldn’t be able to do it through the charging cable though lol

abofh• 2 months ago

It's a car the charging port is a viable physical perimeter, letting people inject code at the pump is a risk of design, not user error.

aussieguy1234• 2 months ago

I mean its still technically hacking, but not all hacking is bad/illegal.

zelon882• 2 months ago

I thought the same thing. How white hat do you have to be to consider ineffective DRM a vulnerability?

wolrah• 2 months ago

This exploit is delivered through the charging cable to the wall box. These wall boxes are sometimes intentionally located in public spaces with the intent of allowing public charging, and Tesla has features specifically for that use case, so that cable is absolutely expected to be plugged in to untrusted vehicles.

_flux2• 2 months ago

It clearly seems people have different meanings to the word, then.

For example, if I am able to gain root access to a WiFi access point I own, even though the vendor has tried to prevent it, then yes, I would call it a hack. To me, it doesn't matter why or who is doing the steps.

In fact, I believe I have never before heard someone combine the meaning of the word to be related to the ownership of the device being hacked.

I suspect the number of people understanding the word in your way is a minority. Redefining terms doesn't help build mutual understanding: here we are taking a word some think has negative connotations and then remove the thing they think should be cool and ok, and then suggest that this is actually the real meaning of the word. Personally I don't think this is how words should be wielded.

oneshtein• 2 months ago

For example, if I am able to gain root access to a WiFi access point I own, even though the vendor has tried to prevent it, then yes, I would call it a hack.

Yep. The owner of the device can sue you.

wtallis• 2 months ago

In fact, I believe I have never before heard someone combine the meaning of the word to be related to the ownership of the device being hacked.

Ownership implies authorization, and using the term "hacking" exclusively to refer to gaining unauthorized access to someone else's computer is a common usage that you must surely have encountered before.

thejazzman• 2 months ago

PSA: If your wall connector loses wifi, it'll just throw your charging schedules out the window and turn on/off sporadically. This is especially noteworthy if you have Time of Use billing :| SET THE TIMER ON THE CAR DIRECTLY!

rblatz• 2 months ago

I spent an hour yesterday getting the wall connector back on my wifi. Apparently last October when I added wifi 7 access points my network started working in WPA2/WPA3 mode and the wall connector wasn’t compatible with that. Ended up having to create a second SSID with WPA2 only support to get it back online.

Supposedly the newest update fixes that, but I haven’t taken the time to test that out.

But WiFi is shocking my fragile on these wall connectors, I’ve had a lot of trouble keeping it connected to my home network over the years.

f001• 2 months ago

Does the tesla wall connector offer Ethernet? Honestly I feel like most devices that are not expected to move around should at least offer it as an option (exceptions being for things where it’s not feasible like smart bulbs, smart locks, etc). If anything it’ll remove congestion for things that can’t realistically be wired.

a10c2• 2 months ago

or, use Home Assistant to handle your charging schedules.

darkwater2• 2 months ago

or even better, use EVCC https://github.com/evcc-io/evcc

eleveriven• 2 months ago

It also fits the broader theme here: too much important behavior seems to live in the "application layer" of the charger, while the more durable source of truth is elsewhere.

chrisandchris• 2 months ago

I have a Volvo. Twice a year when DST changes, the schedule is afterwards one hour off. Been this for 3 years now.

cryptoegorophy• 2 months ago

Why use Tesla wall connector in a first place and not just the standard nema/dryer outlet with the Tesla cord/charger? It seems like people are overpaying for nothing.

tenuousemphasis• 2 months ago

I can do 48A @ 240V with my wall connector. It's also very convenient.

thechao• 2 months ago

I do as well with a NEMA?

jp1919193• 2 months ago

It costed less for me to install a tesla wall connector over a NEMA receptacle, as the NEMA 14-30 and 14-50 require a neutral wire and a GFCI breaker.

elteto2• 2 months ago

Do dryer outlets work outdoors?

jp1919193• 2 months ago

They do. As long as installed properly with a GFCI breaker.

stronglikedan• 2 months ago

You don't want to use a standard outlet, since it's not designed to handle full current(?) for hours. There are special outlets for EV charging, and they work outdoors. Just be very sure to have a GFCI breaker behind it.

doublepg232• 2 months ago

I did a lot of research on home charging at r/evcharging and the consensus always favored hardwiring your EVSE if possible.

spacebanana74• 2 months ago

One thing I'm really scared of is EV charger software being modified by users, hackers or bugs to pull max power at times that don't suit the grid.

In the UK, for example 10 million EVs all pulling 7kw would overwhelm the roughly 70GW potential of the grid. Even a million EVs charging at an inconvenient time could add a 7GW draw which is enough cause a problem.

braiamp• 2 months ago

It will first damage the batteries very fast, second, most users don't want to mess with that, they want to plug and play. So, on both counts your fears are misplaced.

spacebanana74• 2 months ago

In the event of an internet outage, wall box chargers are legally required to default on. In practice most chargers interpret this as taking the full 7kw - whether this is a bug or misreading of the intent of the law doesn't really matter from the perspective of the grid.

Large ISP outages that affect millions of people are not uncommon on a decade by decade basis, and I suspect an uncomfortable number of UK EV chargers are in some way linked to eu-west-2.

[1] https://www.legislation.gov.uk/uksi/2021/1467/regulation/7/m...

alt2273• 2 months ago

It sounds like a genuine attack vector to me. If someone hacked say teslas firmware supply chain and made all chargers pull max power at the same time, it could be a national infrastructure crippling attack.

neilalexander• 2 months ago

Incoming voltage monitoring is a requirement for EV chargers in the UK. The sudden huge demand would result in a voltage drop, the chargers would then detect the under-voltage condition and they'd stop charging.

spacebanana74• 2 months ago

Would the voltage drop before the fuse blew in local transforms?

Modern grids have batteries to manage instantaneous spikes of demand so there’d be a race.

ac29• 2 months ago

I've never seen a charger in the US that doesnt operate 24/7 regardless of grid load, is this different in other countries?

Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet

Related Stories