Tesla Model S Ethernet Network Explored

http://www.dragtimes.com/blog/tesla-model-s-ethernet-network-explored-possible-jailbreak-in-the-future

by tty • 12 years ago

183 107 12 years ago

rrouse• 12 years ago

Interesting that it phoned home

mitchellh2• 12 years ago

The cool things: Tesla is running Linux (!) and standard technologies/protocols such as SSH, NFS, X11, HTTP, etc. to do things in the car. That is cool, and probably highly efficient since developer test labs can probably just be basic Ubuntu-like virtual machines.

The sketchy things: Jailbreaking a car seems pretty dangerous, especially since as far as I'm aware, the electronic systems control things including the brake. I know this only because Tesla recently released a software update that added "hill assist" which will hold the brake in place for 1 second when at a certain incline to avoid rolling back. Imagine a malicious software update that disabled the brake! Personally, I would jailbreak a phone, but not a car. :) HOPEFULLY the system the ethernet port provides access to is firewalled out of being able to update any software (i.e. the software update mechanism is some other device), but who knows.

The phone home can also be considered sketchy, but any Tesla owner is well aware the car pings home and relays diagnostic data to Tesla. At the very least, Tesla owners know it must ping home to check for updates periodically.

If anything, I thought it was kind of cool that Tesla engineers detected it and reached out so quickly. Imagine if you weren't tampering with your car and it WAS a high-tech attacker. It is good to know that they can detect the basics.

jcdavis• 12 years ago

No way is the drive control software is running linux, its almost certainly running on its own embedded system.

mitchellh2• 12 years ago

Absolutely, I agree, but the software update mechanism is somehow able to update or interface with that system. If you're able to jailbreak _that_, then its one less barrier in the way of taking over the drive control.

Mister_Snuggles• 12 years ago

You are correct.

According to the article, the car's network consists of three devices - the centre console, the dashboard, and one unknown device. There's no way that the whole car has only three computers.

My guess is that this ethernet network is only for the user interface. I'd also guess that the unknown device serves as a gateway (and, hopefully, a firewall) between the critical systems of the car and the car's UI.

mschuster917• 12 years ago

...which you can hack, as all car systems are connected by the CAN bus, and people already have exploited buffer overflows in car radios, in turn giving access to the CAN bus, and unlocking the vehicle.

eik3_de3• 12 years ago

likely using a real time os like qnx/vxworks for the more critical stuff.

hamiltonkibbe2• 12 years ago

Unless someone re-wrote the kernel to be MISRA-compliant...

MISRA Compliance...Coming soon in Ubuntu 149.04 Zany Zealot!!</s>

XorNot• 12 years ago

Depends what level we're talking about surely? SpaceX have their own real time Linux which they do use on rocket systems - stands to reason they might bring a similar idea over to automotive systems.

fleitz• 12 years ago

Now... imagine you have a low tech car facing an attacker armed with a pair of side cutters.

First, locate the hood, second, use the release to pop it. Locate the master cylinder, and the hose running to the engine, cut it. Now the brakes don't work very well. Locate the hose not running to the engine, cut that, now the brakes don't work at all.

Imagine that any person strong enough to operate side cutters can hack into your car and disable the brakes.

langseth• 12 years ago

Is it even that complicated? Just cut one (or all 4) of the lines under the car that runs to the brake calipers. No need to get under the hood.

gramasaurous• 12 years ago

Now imagine someone hiding in the hood of your car waiting to cut your brakes while you are traveling 80mph down the freeway.

taternuts2• 12 years ago

You're almost certainly going to notice you have no breaks way before you're going to be at a speed to do serious harm, especially in an urban setting.

evv2• 12 years ago

Seriously? You're illustrating the point here. On low tech cars, an attacker has to hack the cars one-at-a-time. They could endanger one car load of people with each "job".

With high-tech cars, an attacker could hack every car of the same model. With thousands of Teslas on the road, I think it merits a higher concern than somebody with side cutters.

I thought it was obvious. Next time I'll let it go unsaid..

dalke3• 12 years ago

You started with jailbreaking then transitioned to malicious software update - aren't those two different things? While it's possible that bad software would cause dangerous problems with the car, it's also possible that a bad repair job or bad part will as well. Yet we allow unlicensed mechanics, like the owner of the car, to do things like replace the brakes.

While you may not be comfortable jailbreaking your own car, you might also not be comfortable replacing your own brakes? Do you think my replacing the brakes of my own car would also be sketchy? I am a better programmer than I am a car mechanic. Also, after-market mods which reprogram the engine have been around for a while, so it's not like people do things like this already.

taternuts2• 12 years ago

I'm assuming the critical stuff is pretty walled off, but if I were Tesla I'd be nervous about someone potentially poking around with anything like that because they think they know what they are doing.

driverdan• 12 years ago

“Tesla USA engineers have seen a tentative of hacking on my car.”, “can be related to industrial espionage and advised me to stop investigation, to not void the warranty”.

So long as you don't cause any damage they can't void your warranty in the US thanks to the Magnuson–Moss Warranty Act.

eridius• 12 years ago

Poking around an unknown device's network and sending arbitrary commands to see how it responds could certainly very well damage something.

threeseed3• 12 years ago

So could poking around the physical components of the car.

But people are well within the right to do so.

Maxious• 12 years ago

On page 53 of the "Adventures in Automotive Network and Control Units" paper there's a photo of what happened to the researchers garage after a command to run diagnostics on the brakes left the vehicle unable to stop even at slow speeds http://illmatics.com/car_hacking.pdf

jnbiche2• 12 years ago

And that's a mighty hacker-unfriendly stance to take for a company whose client base is made up of a disproportionately large number of engineers and computer scientists, many of whom will doubtless be curious as to the inner workings of their car computer systems.

I mean, could you imagine if a car manufacturer took this attitude toward car owners who were exploring the car's transmission, which is clearly just as critical to the car's safety as the car computer system?

My view of Tesla just sank a notch (but I still want one).

Edit: Actually, I thought about it a bit, and I actually don't want one anymore if this is the attitude that prevails inside the company. For the same reason that I don't want any Apple products. I'm far from a Stallman acolyte, but I'll be damned if I'll buy from a company that wants to forbid me from hacking on hardware that I have purchased and own.

takeda• 12 years ago

Given that the fires were blown out of proportion by the media, I'm totally not surprised that they reacted this way.

Imagine headlines if someone would be killed due to not correctly operating component because the owner used a buggy mod.

sebastianavina• 12 years ago

Maybe all the source code of the media system is written in Python, and everybody can see / modify the code..

Vespasian2• 12 years ago

I think there is a difference between hacking (or even exploring) something like a phone, game console or router and a car, plane or any other thing that can immediately put in danger the live and health of many unrelated persons.

Therefore I thinks Tesla acts as responsible as they should when detecting and reacting upon active (as opposed to passively analyzing radio transmissions) manipulation of their cars inner systems. As other comments have pointed out you don't want to find out about bugs in critical systems triggered by your entertainment system jailbreak when driving with 100km/h+ on a crowded highway.

Your phone hack / mod fails badly => Buy a new phone Your car hack fails badly => People die

It's simply not worth it.

afhsfsfdsss88• 12 years ago

As a hacker...Cool!

As a driver who will have to occupy space around people playing with this while driving...F#&*!

chris_mahan2• 12 years ago

Agreed. There should be a large warning on the console: "Warning to passengers: The Vehicle Systems have been Compromised. Please do not ride in this vehicle. A Service tow truck has been dispatched."

Also, the car should not move.

lvs• 12 years ago

Do you think the same thing about a car where the owner has, say, installed aftermarket brake calipers and suspension components? ... Because that's incredibly common.

jnbiche2• 12 years ago

Wow, as someone who grew up "hacking" on my car (i.e., on the engine) this attitude is pretty amazing. What a dangerous, mysterious thing a car must seem to you.

mschuster917• 12 years ago

A quick google for the source code only revealed http://www.teslamotorsclub.com/archive/index.php/t-10748.htm... - apparently Tesla has never released the source code of the "modified Ubuntu" they're using.

Whoops.

Also, looks like Tesla has got international deals with mobile carriers for data flatrates. I'm looking forward to see the first guy stream youtube or youp*rn on the dashboard :D

eik3_de3• 12 years ago

If they don't modify gpl code but just configure existing software and add their own packages, do they still have to pub everything?

mschuster917• 12 years ago

Yes, you at least have to say where to get the source from if you publish/distribute binaries to others.

nandhp• 12 years ago

Moreover, it's my understanding that if there's any GPLv3 software on the Tesla, you have the right to receive installation instructions that allow you to install a modified version of that software on your Tesla. But Tesla is not required to honor the warranty of Teslas whose software has been modified.

I wonder if they ship coreutils?

jwise0• 12 years ago

The original thread that this came from:

http://www.teslamotorsclub.com/showthread.php/28185-Successf...

Interesting in particular is one poster's claim that Tesla gave him a seemingly-dismayed call...

http://www.teslamotorsclub.com/showthread.php/28185-Successf...

dm22• 12 years ago

Can Tesla detect if settings or the files for one of their cars are modified?

I would like an option to contact home base to verify that all files and configurations in my car are exactly like their suppose to be, else either disable the car or download the correct software.

Maybe a way to enable a developer mode which can only be used on a non-public road.

I just can't imagine modifying an electric vehicles computers and settings for anything useful. Please offer some suggestions if you can.

deevus• 12 years ago

Nice. A bit like Steam's verify game cache.

hamiltonkibbe2• 12 years ago

I could certainly see people modifying cotor controller settings. Changing hard RPM limits, or tuning PID controller gains for extra milliseconds on the track.

dm22• 12 years ago

I doubt there is too much that can be done to increase the performance. Removing seats seems like it would be more effective than messing with RPM limits.

http://www.teslamotorsclub.com/attachment.php?attachmentid=2...

I just don't think it's worth compromising safety and implementing more systems (to regular where the modified cars are driven) to satisfy the small percentage of people who want to use a Model S as a serious track car.

It's already pretty competitive on the track https://www.youtube.com/watch?v=VLCdP6sMN9k

One wreck from a modified Model S would be disastrous for Tesla, it's just not worth it at this point in my opinion.

DasIch• 12 years ago

In Germany you have to get your car checked every two years by the "TÜV", if it passes you get a sticker for the license plate without which you are not allowed to drive the car.

Given how critical the software already is, I would be surprised if there isn't a system already in place, that car companies are required to put in, that can use to verify the software for any car.

AceJohnny2• 12 years ago

I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems.

Automotive systems communicate over a CAN [1] bus, not ethernet. In fact, this bus is usually physically separated between drive-critical bus (which controls things like ABS) and "comfort" bus (such as electric window controls, central door locks, wheel-mounted audio controls). Ethernet has none of the industrial strength qualities that make CAN a valid automotive control bus, such as signal hardening and real-time guarantees.

As far as these users have found, this ethernet port is connected to the infotainment system: the 17" display.

I would be deeply disappointed in Tesla if the infotainment system can modify drive-control devices with anything less than signed binaries and commands. As an aside, I wonder what the legal requirements of such safeties are.

[1] http://en.wikipedia.org/wiki/CAN_bus

threeseed3• 12 years ago

I guess the point is that signed binaries aren't full proof. Look at how jail breakers have been able to continually defeat the iOS security controls over the years. And surely Apple has a larger and more experienced development team than Tesla.

the_ancient• 12 years ago

Why would you believe that?

Apple is mainly a Design firm, they are good at making things look pretty... not much else..

Dwolb• 12 years ago

Just a note, automotive Ethernet PHYs exist [1] and there is some interest in real-time Ethernet applications (piggy-backing on an original audio use case, AVB) [2].

[1] http://www.broadcom.com/products/Physical-Layer/BroadR-Reach... [2] http://www.eetimes.com/document.asp?doc_id=1315425

mikepurvis• 12 years ago

There's also EtherCAT, which has been around for a while and has realtime and safety guarantees.

PinguTS2• 12 years ago

Yeah, BroadR-Reach is currently used by BMW only. There will be more used cases, but I can't talk public about for obvious reasons. But then, don't expect to have TCP/IP available, like this article suggest.

anologwintermut2• 12 years ago

Sadly, the segregation between CAN buses is not nearly as good as you would think. ONSTAR, for example, sits on the drive critical bus (and is exploitable). Of course, this is not on a Tesla, but still.

http://www.autosec.org/pubs/cars-usenixsec2011.pdf

el_benhameen• 12 years ago

I'm probably missing something here, but wouldn't it make sense for ONSTAR to sit on the drive critical bus? If it's able to monitor collision data and (in newer models) slow down a stolen car, it'd need access to drive-control systems.

tlrobinson• 12 years ago

Assassination via car hacking would have seemed like sci-fi a decade or two ago.

See Michael Hastings conspiracy theories: http://www.huffingtonpost.com/2013/06/24/michael-hastings-ca...

gcr3• 12 years ago

A few years back, a joint UW-UCSD team showed that car systems are remotely exploitable. They were able to literally call the car's cell phone number and control the brakes/gas/door locks remotely.

http://youtu.be/bHfOziIwXic

Vik1ng• 12 years ago

I'm not expert on this, but I'm pretty sure the IT guys in our Formula Student Team use a Ethernet cable to connect their laptop to the Autobox and then the Box runs the CAN signals.

http://www.dspace.com/de/gmb/home/products/newprod/microauto... (Table: Host-Interface = Ethernet)

mschuster917• 12 years ago

You can be disappointed - you can unlock the vehicle from your app, thus 0wning/jailbreaking that box will give you CAN-bus access.

mdorazio2• 12 years ago

Thank you for pointing this out. A few additional notes on the way most modern car electronics work:

1) The entertainment system generally has read-only access to the CAN bus via an intermediary DCU. Even if you were able to "jailbreak" it, you wouldn't be able to modify the CAN.

2) The control unit(s) that actually have the ability to modify things like brakes, maximum speed settings, etc. are ECUs (http://en.wikipedia.org/wiki/Electronic_control_unit) and are entirely separate from the entertainment system.

3) Updates to vehicle-critical systems generally never even go through the entertainment system. They are sent over the air to the car's receiver (usually a kind of DCU), and are processed outside the purview of the entertainment system. The only thing the entertainment system can do is schedule the download and read the progress of the update.

It's interesting to see that Ethernet is used to connect the infotainment displays, but this isn't really a security concern as far as I can see. It just means we'll probably see some mods for the displays in the future, like turning off the YouTube lockout or enabling different data displays.

rjsw• 12 years ago

There isn't any reason why the entertainment system couldn't reprogram the ECUs, I have never seen a read-only CAN controller so the hardware will be able to write to the CAN bus. The OBD-II diagnostic connector provides full access to the CAN bus anyway so once you are inside the vehicle there isn't much security.

You could even run the service diagnostics on the entertainment system and avoid the need for extra hardware in repair shops.

sliverstorm• 12 years ago

That was my first fear, actually. Reading the headline, cold chill "They can't have been stupid enough to build the Tesla with Ethernet instead of CAN bus, right?"

TeMPOraL3• 12 years ago

I am very amused that people in this thread assume that this ethernet port allows tinkering with the automotive systems.

I'm still surprised people think like this. We had 60+ years of technology hacking to learn that if it is not airgapped, it can be hacked. And even if it is, it probably still can be (cf. Stuxnet). So while I doubt Tesla is using Ethernet to control critical car systems, I also don't think that they can't be tinkered with using that port if someone cares hard enough to try.

marincounty• 12 years ago

Agree-

gcr3• 12 years ago

Some high-end luxury cars are remotely exploitable, to the point where attackers can control the breaks/engine/locks using a cell connection: http://youtu.be/bHfOziIwXic

miah_• 12 years ago

Super interesting. There was this hack from a few months ago that involved messing with items on the CAN bus. I think they get into more of the details;

https://www.youtube.com/watch?v=oqe6S6m73Zw

kalleboo2• 12 years ago

What about cars where you can enable/disable features like traction control and auto-break from the entertainment system? They must have some sort of connection, and that connection probably has bugs that could be exploited.

Theodores• 12 years ago

Onto more important matters, does anyone know the track being played?

The title is 'All the things she said', which originally was a #1 Top 40 song by the Russian pop group 'Tatu'. However the picture is definitely not the Russian duo. Is this a German cover version of some sort?

nemo1618• 12 years ago

I tried reverse image searching the photo, but got nothing.

However, a simple YouTube search for the song name turned up a bunch of cover versions. This one matches the length shown (4:17): https://www.youtube.com/watch?v=tytPcvyJASc

The band, Simple Plan, also appears to have five members, which is pretty strong supporting evidence. Strangely, I couldn't find the exact image shown in the Tesla photo.

scotty79• 12 years ago

So, inspecting a product you own is industrial espionage now?

lelf• 12 years ago

Source: http://www.teslamotorsclub.com/showthread.php/28185-Successf...

zw123456• 12 years ago

Someone should post some wireshark pcaps.

csense• 12 years ago

How can the car communicate with the Internet? Does it have a cell modem or something? Is a lifetime subscription included in the purchase price of the vehicle, or does the user get a monthly bill?

Wouldn't a real industrial espionage operation disconnect or Faraday cage the vehicle's remote communications capability as their very first step? If you were trying to reverse engineer Tesla's secrets, would you really care about voiding the warranty?

Tesla Model S Ethernet Network Explored

Related Stories