16 ms·

Tesla PowerWall 2 Hack

466 points by amai 7y ago

mdorazio 7y ago
Did they even try to submit these issues to Tesla? They have a bug bounty program and have been reasonably good about patching issues in vehicle software. If not, this is pretty irresponsible disclosure.
- lizmat 7y ago
  This is not a bug. This is irresponsible behaviour on the side of Tesla, providing hardware that is so open to abuse. With potential effects to the grid as well.
  - optimiz3 7y ago
    How is unintended behavior not a bug?
    - Chyzwar 7y ago
      A bug is when something is not working as intended. Tesla's intention was to quickly deliver without considering the security aspects of the product. This is potentially dangerous as attacker can just drive around hacking power walls and schedule an attack on the grid.
      - optimiz3 7y ago
        > Tesla's intention was to quickly deliver without considering the security aspects of the product. [Citation needed] You're assigning intentionality where incompetence would suffice.
        FireBeyond 7y ago
        I would argue that "building, and leaving open" Wifi connectivity that is not even remotely obfuscated is proof in itself of "failure to consider security aspects".
        drdaeman 7y ago
        Well, to be fair and comparing to not having a password at all - as they put those passwords in place they have somehow tried to protect it. Or make it look protected. But I agree that it indicates that they haven't gave any consideration to it, and in 2019 that doesn't count as trying anymore. At least because we're talking about a well-established hardware and software vendor, not my grandma.
    - ivanbakel 7y ago
      Complete negligence in security is hardly the kind of thing people think about as "bugs". The larger problem is that Tesla has put out software without any sensible considerations for security - that the result behaves badly can't really be called unintended behaviour, unless you are allowed to design software by pipe dream.
    - dx87 7y ago
      This is unintended behavior in the same way that a locksmith leaving a copy of a key under your doormat after installing a new lock is unintended behavior. They didn't intend to cause a security issue, but they also didn't care enough to make sure that what they were doing was safe.
      - optimiz3 7y ago
        Unauthorized access (in the legal sense) is definitely unintended, regardless of whether it's caused by weak design or code defect. Posting 0-days on GitHub isn't responsible disclosure. The real test will be to see how fast it gets fixed and what the fixes end up being.
    - Someone1234 7y ago
      If it is documented in the manual[0][1] is it a "bug?" I think the design is poor (bad default WiFi password, WiFi always on, inverting sensors with no sanity checks) but this is how it was designed to work, it is officially documented as doing so. I guess it boils down to a definition of the term "bug." But I feel like a lot of the knee-jerk responses (and voting) didn't read the article carefully enough. It is a core design weakness rather than a "bug" (implying an error) in an actual good design. I think the distinction is subtle but it is there. [0] https://www.tesla.com/support/energy/powerwall/own/monitoring-from-home-network https://www.tesla.com/support/energy/powerwall/own/monitorin... [1] http://azmag.gov/Portals/0/Documents/MagContent/Tesla_Powerwall%202_AC_Utility_Documentation.pdf?ver=2018-02-22-161139-873 http://azmag.gov/Portals/0/Documents/MagContent/Tesla_Powerw...
      - JaRail 7y ago
        Not having any limits on that invert setting is definitely a security/safety bug. The password is a level of incompetence beyond what you'd call a bug. It's clearly following a design decision that was imposed by someone with zero security experience.
    - AnthonyMouse 7y ago
      It's not clear that most of this is even "unintended behavior" rather than just abuse. It's like calling it a "hack" to fill water balloons with electrically conductive fluid and throw them at a substation. The people responsible for stopping you from doing that are the police, not the makers of water balloons. The worst thing they did was the default password.
  - mlindner 7y ago
    Nonsense. You can twist any bug into "irresponsible behavior".
- FireBeyond 7y ago
  "Responsible disclosure" is an invention of vendors who want you conforming to their policies and timelines (and more). Tesla is also "good" at disabling aspects of people's property (like ethernet ports, or ability to receive future firmware updates) when they dislike what people find "wrong" or otherwise in Tesla software.
  - zamadatix 7y ago
    You're always welcome to disclose to the company and follow your own timelines and policies. Presumably this doesn't change whether you tell the company first or post it on your GitHub. Shitty either way but irrelevant.
  - corndoge 7y ago
    You can do responsible disclosure without following a vendor's timeline. Project Zero comes to mind. It's not like the only options are either dropping 0 days or doing exactly as the vendor says. Simply give a date. At the end of the day the point of security research is to make things more secure. Oftentimes that is best achieved by working with the vendor.
  - kortilla 7y ago
    > "Responsible disclosure" is an invention of vendors who want you conforming to their policies and timeline No it’s not. It’s an invention of ethical hackers and academic security researchers who are mature enough to realize that dropping 0-days to the public is worse for society than giving the vendor a reasonable opportunity to fix it. “Economics of information security” is a field that publishes some studies about vulnerability disclosure strategies and maximizing the social good.
    - FireBeyond 7y ago
      Some interesting commentary: https://news.ycombinator.com/item?id=14010010 https://news.ycombinator.com/item?id=14010010 https://news.ycombinator.com/item?id=12308246 https://news.ycombinator.com/item?id=12308246 > That may feel good to say, but as someone whose job it was to find these kinds of bugs in software from companies ranging from tiny startups to financial exchanges to major tech vendors, this is a kind of carelessness shared by virtually everyone shipping any kind of software anywhere. > That said, the term "responsible disclosure" is Orwellian, and you should very much avoid using it. > It's coercive. It redefines language to make any handling of vulnerabilities not condoned by the vendors who shipped those vulnerabilities "irresponsible", despite the fact that third parties who discover vulnerabilities have no formal duty to cooperate with those vendors whatsoever. > The better term is "coordinated disclosure". But uncoordinated disclosure is not intrinsically irresponsible. For instance: if you know there's an exploit in the wild for something, perhaps go ahead and tweet the vulnerability without notice!
- setr 7y ago
  This doesn't really even seem like much of a disclosure to be had. The system is mostly open without authentication, and what little auth exists is behind a trivial-to-break password. I mean hell, the main "hack" is looking at the API calls.
- simion314 7y ago
  >this is pretty irresponsible disclosure. This is what corporations claim, an example that makes you think about the "irresponsibility" of disclosure is the Intel security bugs, Intel sits quiet for 1 year (and more if it's bribe would have worked) and customers are tricked to buy insecure products. As a possible future customer you would like to know that something is insecure before you buy it , keeping it hidden will just increase the number of affected people.
  - dfabulich 7y ago
    You're worried about future customers, but what about Tesla's existing customers? For their sake, researchers should at least give the company a chance to respond and fix the issue before public disclosure. I agree that a year is too long. I think 30 days is about right, but it depends on how fast the product is selling, how many new customers might be harmed during the 30-day period vs. how many existing customers there are. How many customers do you think have already purchased a PowerWall, vs. how many would have purchased in the next 30 days?
    - simion314 7y ago
      I would agree if and only if is a super hard to find issue, but if any curious teenager can find and abuse this then keeping is secret is making more harm. If your car had a bug where it could be controlled remotely by any teenager with a laptop and a program do you want to know and stop using the car or block it's internet connection or prefer Tesla has it's 90 days to find a fix. Anyway let's see what harm comes from this being revealed and maybe I will change my mind.
- raven105x 7y ago
  Irresponsible disclosure is releasing products and services with flaws like these onto the open market - the rest is corporate doublespeak.
- newnewpdro 7y ago
  These issues seem fairly obvious to me. Anyone interested in powerwall vulnerabilities would find them trivially. In this case I think the value is in embarrassing Tesla for their gross negligence so they do better in this area before shipping. When you disclose such things quietly with the vendor, it mostly just saves their face. Not everyone values saving Tesla's face.
  - CivBase 7y ago
    > Anyone interested in powerwall vulnerabilities would find them trivially. What about those who become invested in powerwall vulnerabilities because they read an article on HN that showed how easy it is? > When you disclose such things quietly with the vendor, it mostly just saves their face. I don't see how. They still get put on blast for ever being vulnerable in the first place. If you're goal is to get them in more trouble at the expense of their consumers, then that seems like pretty irresponsible disclosure to me. > Not everyone values saving Tesla's face. And not everyone cares one way or another about Tesla. This is about responsible disclosure. It's about protecting the consumers. It has nothing to do with the vendor.
  - marvin 7y ago
    It can also give you a five- or six-figure payout and prevent unsuspecting customers of being hit by a disrupting and damaging attack, causing unnecessary economic damage. IMHO, choosing the priority of embarrassing someone rather than give them a 24-hour window of notice to avoid this would be a shitty move. This should be short-term trivially fixable by pushing a password update that sets unique passwords based on a SN -> password mapping stored in a DB at the vendor. You don't need more than 24 hours to do that.
    - FeepingCreature 7y ago
      Not like they couldn't have done that before now.
- peteradio 7y ago
  What is the bug exactly? Its not like there is some complex sequence to trigger any of this shit, its just sitting there because it's a terrible unsafe design. This is more of a critique of design than any zero day bug post. This is all in the goddamn manual.
- sneak 7y ago
  There is no such thing as irresponsible disclosure. You are allowed and encouraged to publish your security research WHENEVER YOU FEEL LIKE. The term “responsible disclosure” is a shady tactic to frame publishing immediately and in full to those affected by the vulnerability as irresponsible. It is not.
  - CivBase 7y ago
    > The term “responsible disclosure” is a shady tactic to frame publishing immediately and in full to those affected by the vulnerability as irresponsible. It is not. What? Have you even tried to understand what responsible disclosure is? It is about giving the vendor a chance to protect their consumers before teaching the public how to exploit a vulnerability. The vendor still gets put on blast when the vulnerability is eventually disclosed. But at least there is less risk of the vulnerability being exploited in the mean time. And if the vendor doesn't fix the vulnerability in a reasonable time frame, they get extra blast. We've seen this happen many times. The recent Valve and Intel incidents stand out to me as good examples.
    - sneak 7y ago
      The vendor’s existence and actions are irrelevant to whether or not it’s okay to publish your research at any time. It is never irresponsible to disclose one’s research in public, in full. Vendors don’t factor in to it at all.
      - HereBeBeasties 7y ago
        Their customers do, though, and that's the whole point. Without giving people a short, reasonable time to patch, you're part of the problem, not part of the solution. For what it's worth, you are also coming across as something of a zealot, rather than a reasonable person who sees the world in shades of grey.
        sneak 7y ago
        The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. The side effect that it is available to attackers is also irrelevant to the determination of whether or not it’s irresponsible; it also becomes available to the vendor who shipped it. This notion of “you have to give the vendor time to patch xor you are irresponsible” is itself bogus. The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is.
- bildung 7y ago
  > If not, this is pretty irresponsible disclosure. Tesla was the institution that irresponsibly shipped broken hardware. Don't shoot the messenger.
nemosaltat 7y ago
Can’t believe Tesla would ship something with anything resembling a default password. At first glance, I assumed this would be a clear violation of the requirements of CA SB-327 (goes into effect Jan 1). Reread the bill, and it actually says: “The preprogrammed password is unique to each device manufactured.” If the default is based on the serial number, I guess it’s “unique” under the letter, but certainly not the spirit. Link to bill: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...
- jolmg 7y ago
  Reminds me of a time when an ISP would provide their customers routers where their default Wifi passwords could be derived from their SSIDs. A free app would allow you to connect instantly to practically any Wifi network in the city.
  - gpm 7y ago
    An ISP around here still ships consumer routers with passwords consisting of a random 8 digit hex number, i.e. that could be cracked in a day on a GTX 970m (tested hash rate against my parent's wifi). They also ship with default SSIDs, numbered 100 to 999, so given 900 GPU days of precomputation you could create rainbow tables that allow for cracking every default password/ssid pair. I can tell you from the wifi passwords I have been given by friends that many people are not changing them. At least you need to capture a handshake to use your rainbow table...
    - SECProto 7y ago
      > They also ship with default SSIDs, numbered 100 to 999, so given 899 GPU days of precomputation That would be 900 GPU days actually - off by one error
      - deleted 7y ago
        [deleted]
      - 7y ago
joeraut 7y ago
I'm amazed Tesla went ahead and used easily guessable and unchangeable passwords. It's just such a trivial and obvious issue that it seems strange Tesla engineers let this happen. I wonder if this was an off-the-shelf solution they're using here, or was developed by external contractors, for lack of a better explanation.
propercoil 7y ago
So many people like to nitpick when it comes to Tesla, It reminds me of the Apple critics in the early days of the iphone. They assume Tesla should have the highest standard and be absolutely impeccable with all their products. Just don't buy it if you don't like it. Let the rest of us enjoy a sustainable future with insanely safe full self-driving electric cars.
- ajross 7y ago
  This is absolutely true, and the blog post itself definitely has a little of that "picking on Tesla" vibe. And I think it's unfair too. But at the same time, this is pretty genuinely bad security architecture, and it really needs to be exposed and embarrass the company that did it. Tesla does some great stuff. This thing seems a little mailed-in, though.
- loeg 7y ago
  The first iphone doesn't self-propel itself to 60+ mph nor was it capable of remotely damaging critical electric infrastructure. It was a toy. When you're working in higher risk domains, higher safety standards are reasonably demanded.
- JaRail 7y ago
  > Just don't buy it if you don't like it. You say that about a security issue that could blow California's power grid in minutes.
  - yellowapple 7y ago
    In fairness, so could a strong breeze, apparently. Thanks, PG&E!
    - JaRail 7y ago
      Alright, I'll admit you made me laugh :D
- astronautjones 7y ago
  this is an exploit that allows an attacker to disrupt the electrical grid - even if it's only to the substation, that effects all of your neighbors that didn't encourage you to blindly support Tesla's endeavour. it's highly irresponsible to have this kind of control behind such a trivial login on something that connects to your power lines, something extremely dangerous. far from a "nitpick"
xoa 7y ago
I have a couple of PW2s installed, connected via ethernet only (isolated on its own VLAN, though Tesla is total garbage about basics like "what firewall rules are needed"), no cellular here either. But the TEG-$(SERIAL){3} network has always been right there anyway, which is just really lazy design. I happen to be physically far enough away from anyone else that it's very unlikely to be a security issue in practice, but it's still unnecessarily polluting WiFi even beyond that. This has been noticeable for a long time too, it's not hard to find threads going back a long ways with people asking how to disable the gateway WiFi, ie., ( https://teslamotorsclub.com/tmc/threads/disable-gateway-wifi.157212/ https://teslamotorsclub.com/tmc/threads/disable-gateway-wifi... ), or people speculating about the obvious vuln/interference implications. From that thread back in June: >It would be nice to find a way to turn off the TBG's WiFi hotspot. I already have too many WiFi hotspots in my area for my taste. TBG's broadcasting WiFi is just a exploit waiting to happen. The whole thing is genuinely perplexing. Dependence on WiFi, while regrettable, I guess can sometimes make sense from a "user friendly" perspective for a lot of typical consumer installed gear. But the PowerWalls are absolutely not consumer installable, nor obviously in any way inherently wireless. They represent serious electrical infrastructure, and require professional installation with a lot of run cable. Adding in some shielded cat 5 or whatever along with that is frankly trivial for multi-thousand/ten-thousand dollar professional projects, even when not dealing with people who can do a drop themselves. Minimizing attack area is really trivial security, and here it's got other bonuses like just being more reliable. The entire IOT space is full of shit of course, but it seems much stranger in this instance to me than something like lightbulbs. And why even have passwords at all for access versus using keys? None of this is supposed to be generally accessible anyway. It's not like this would cost Tesla anything extra. Edit to add: HOSTNAME INCLUDES THE FULL SERIAL. I thought I'd take a second look at this and just pulled up the client info for the PW2 Gateway on my network, and hostname is 11XXXXX-00-J--S$(SERIAL). So no local physical access is required, the gateway itself just broadcasts the whole serial, which in light of this is an, interesting, decision. I can confirm that using the hostname with an added S at the front (so on mine serial was T[...], I used the password ST[...]) I was able to connect to the WiFi spot, and in turn to the management page described. Incredible. Incidentally DPI is also kind of wacky now that I look, just running a simple Suricata setup but connections are all over the place (why is YouTube showing up?). About 4.5 GB down and 9 GB up, down I assume would be updates of some kind, up monitoring data though that seems like a significant amount for what should generally be text. I haven't had it that long, must be kind of chatty.
JaRail 7y ago
This is an amazing lack of security best practices. To me, this screams outsourced. Given how many people hate Tesla, they need to be taking this seriously. This truly blows me away. This is "people should be fired" levels of organizational incompetence. There's no way some of these issues haven't already been noticed and put in the issue tracker. They're just not taking it seriously. It reminds me of Boeing to be perfectly honest.
- morpheuskafka 7y ago
  And not just fired for this, but because they are incompetent enough to do something like this in the first place. And that needs to be at however high of a level it was that approved the security plan for this product.
- dogecoinbase 7y ago
  It does not strike me as outsourced, given what we know about software engineering practices at Tesla: https://twitter.com/atomicthumbs/status/1032939617404645376 https://twitter.com/atomicthumbs/status/1032939617404645376
  - xedeon 7y ago
    Yeah, some random Twitter account that was never substantiated. Fact: He never provided proof he is who he said he was.
vermilingua 7y ago
This is the mythical power-grid attack that people have been talking about since the concept of cyber-warfare was first dreamt up. It’s lucky we caught this now, before there are enough PowerWalls to seriously destabilise the grid if this attack were to occur.
- chance_state 7y ago
  > This is the mythical power-grid attack that people have been talking about since the concept of cyber-warfare was first dreamt up. > It’s lucky we caught this now, before there are enough PowerWalls to seriously destabilise the grid if this attack were to occur. I could be misunderstanding you, but do you seriously think that there are not more destabilizing attacks already available? From my reading the US power grid is already extremely vulnerable to attack.
  - rmgraham 7y ago
    I think the observation being made was that this is at the scary intersection of consumer IoT non-security and major infrastructure.
  - londons_explore 7y ago
    Any power grid is very vulnerable to attack. Anyone who can cause a sudden surge in demand can take a power grid down. If you can make power usage unexpectedly go up by more than ~10% within a minute, most power grids will fail. I'm struggling to think of any companies who could do that though... Someone with malicious access to teslas servers couldn't even do that... For example, instruct all plugged in tesla cars to start charging all at once. Assume 400k tesla cars are plugged in overnight, with an average 10kw charge ability. That means tesla could add 4 gigawatts to the grid demand instantly, which is only 0.4% of the USA's ~1TW generation capacity.
    - cesarb 7y ago
      > If you can make power usage unexpectedly go up by more than ~10% within a minute, most power grids will fail. Wouldn't that behave identically to a sudden loss of generation? The power grids I know of have schemes to deal with that, by automatically shedding large blocks of load in several stages.
londons_explore 7y ago
The only bug here is the default password. After authentication, the fact you can make it charge or dump power into the grid is by design. If I wanted the grid to suffer, I can do this by plugging in and unplugging a multi-kilowatt heater every few milliseconds too. Residential properties have a fuse (usually 60-100Amps), and anything you can do without blowing that fuse won't damage the grid.
- Proven 7y ago
  No it's not, it's also the CT Sensor. What a garbage product.
  - londons_explore 7y ago
    In the same way a printer is a garbage product for printing a document landscape when you put the paper in the wrong way round? Product works in safe but unexpected ways when not configured according to reality. News at 10.
- reitzensteinm 7y ago
  The fast switching ability isn't a bug by itself, but it makes the insecure authentication much worse. Shitty IOT auth does not mix with power electronics. Whether Tesla is worse than other providers in this space is another question, and may well have a depressing answer.
  - jacobush 7y ago
    The fast switching is still a failure of defence in depth. It could be internally rate limited to some value (which I don't know), and also with some random backoff value so Powerwalls could not be synchronised.
- malux85 7y ago
  You don’t see any difference between an individual switching a multi-kilowatt heater every few milliseconds vs a malicious actor automating this attack on 100,000 properties over an entire state?
lgats 7y ago
Does anyone have the FCC ID information for a Tesla PowerWall?
vpskalasatama 7y ago
Why does this seem like: "Look at me I am German, I am better than Elon Musk" Just look at Bosch&Siemens&VW
rsync 7y ago
Is there an alternative to the powerwall that is functionally similar, in terms of power density and utility, but doesn't have things like a network stack and other wifi / IoT / "smart" features ? We are just about to install lithium battery backups in our home and, of course, the Tesla powerwalls are an obvious choice, but I don't look forward to having to disable/reenable the network connectivity on them, manually, in some cat-and-mouse with Tesla for updates or whatever... In fact, I'll bet that most (all ?) of the updates that Tesla has to send the powerwalls are for the update system, and accompanying network stack, itself ...
- mattmaroon 7y ago
  Nothing close in terms of cost per kwh.
- obilecantrem 7y ago
  Used Nissan leafs are pretty affordable, might make a nice powerwall.
- peteradio 7y ago
  What is the reason you can't store excess on the grid?
  - marvin 7y ago
    Punitive pricing, or at best you're at the mercy of the grid operators and power companies.
- Nanzikambe 7y ago
  Yes, I'm in France, I contacted the Italian reseller for this company: https://www.freedomwon.co.za/ https://www.freedomwon.co.za/ I got this instead of a powerwall because 1) price per kwh 2) tesla will not let you install your own powerwall, you need to go through an installer and attract all those associated costs (which are significant) 3) better integration with a mixed solar equipment install and pv array 4) powerwall does not support an offgrid installation, or at least did not when I looked into it 5) has canbus to a BMS, you're never obligated to connect to the internet
morpheuskafka 7y ago
The password configs are clearly documented: https://www.tesla.com/support/energy/powerwall/own/monitoring-from-home-network https://www.tesla.com/support/energy/powerwall/own/monitorin...
- 713233eb 7y ago
  > Step 3: Select your home Wi-Fi network and enter your Password. So an attacker can even get LAN access from across the street.
mtgx 7y ago
Makes you wonder if you can trust their "self-driving cars" not to be remotely hacked, doesn't it?
marvin 7y ago
The criticism of this security vulnerability has been well covered at this point, so I'd just like to point out that this should be trivially solvable in a few hours by changing all passwords from HQ. It'd be quite irresponsible of this researcher if they didn't give notice beforehand (don't know if they have).
unnouinceput 7y ago
"The PW can store up to 13.5kW of electric power..." No, you store energy, not electric power, and energy is Wh, that's why you have your phone battery with 5V and 8000 mAh as units and not 8A. "How does the grid feel about me oscilating this and who will die first, the PW or the sub-station?" Definitely the PW. Sub-stations are made to withstand thousand of households switching all at once their light-bulbs at evening and during storms nature electric discharge (ie, lightning strikes). Your measly PW is fully ignored. "Do not try any of these Grid Codes (really, please do not): AU ASS4777.2 DE VDE4105 UK GA59 21A, GA83 16A IT CEI-021 NZ NZS47772 US: IEEE1547 Split Phase 240V 60Hz " I'm a bad boy, I tried them. Nothing happened.
- nexuist 7y ago
  If you were to try this and somehow cause damage to the sub station, would you be held liable? Actually, this brings an interesting question with IoT - if devices damage or otherwise exploit your utility company’s equipment, is it their fault of yours? Presumably doing anything bad is against your utility’s ToS, but if you didn’t do it knowingly...
  - mbreese 7y ago
    I would imagine that unless you were a licensed electrician, you would be liable.
    - KMnO4 7y ago
      I’m sure you’d still be liable if you were a licensed electrician.
  - unnouinceput 7y ago
    Those are commands for your PW, not for sub-station. Like I said, I tried them, and nothing happened. The author is an alarmist and the only valid point he had in the entire article was default password instead of assigning unique one, which is easily to re-configure. Also the last one I suspect might damage your PW ugly enough if you're in US, but I am in EU where I already have 240V, so ¯\_(ツ)_/¯
whattheactualf 7y ago
This is a far cry from a 'hack'. Oof.
chriscappuccio 7y ago
As I'm reading comments here I can't help but remember that Elon Musk was restrained at PayPal from switching the company's server platform from Linux to Windows. It wasn't until Microsoft tried converting Hotmail from FreeBSD to Windows (and failed, and then overhauled Windows) that Windows Server was both fast and reliable enough to be used in this way. Security review for products like this requires a real world appetite for testing. Switching PayPal from Linux to Windows requires testing. The bulletproof glass on the cybertruck obviously should have first undergone testing...

466 points by amai 7y ago

Did they even try to submit these issues to Tesla? They have a bug bounty program and have been reasonably good about patching issues in vehicle software. If not, this is pretty irresponsible disclosure.

lizmat 7y ago
This is not a bug. This is irresponsible behaviour on the side of Tesla, providing hardware that is so open to abuse. With potential effects to the grid as well.
- optimiz3 7y ago
  How is unintended behavior not a bug?
  - Chyzwar 7y ago
    A bug is when something is not working as intended. Tesla's intention was to quickly deliver without considering the security aspects of the product. This is potentially dangerous as attacker can just drive around hacking power walls and schedule an attack on the grid.
    - optimiz3 7y ago
      > Tesla's intention was to quickly deliver without considering the security aspects of the product. [Citation needed] You're assigning intentionality where incompetence would suffice.
      - FireBeyond 7y ago
        I would argue that "building, and leaving open" Wifi connectivity that is not even remotely obfuscated is proof in itself of "failure to consider security aspects".
        drdaeman 7y ago
        Well, to be fair and comparing to not having a password at all - as they put those passwords in place they have somehow tried to protect it. Or make it look protected. But I agree that it indicates that they haven't gave any consideration to it, and in 2019 that doesn't count as trying anymore. At least because we're talking about a well-established hardware and software vendor, not my grandma.
  - ivanbakel 7y ago
    Complete negligence in security is hardly the kind of thing people think about as "bugs". The larger problem is that Tesla has put out software without any sensible considerations for security - that the result behaves badly can't really be called unintended behaviour, unless you are allowed to design software by pipe dream.
  - dx87 7y ago
    This is unintended behavior in the same way that a locksmith leaving a copy of a key under your doormat after installing a new lock is unintended behavior. They didn't intend to cause a security issue, but they also didn't care enough to make sure that what they were doing was safe.
    - optimiz3 7y ago
      Unauthorized access (in the legal sense) is definitely unintended, regardless of whether it's caused by weak design or code defect. Posting 0-days on GitHub isn't responsible disclosure. The real test will be to see how fast it gets fixed and what the fixes end up being.
  - Someone1234 7y ago
    If it is documented in the manual[0][1] is it a "bug?" I think the design is poor (bad default WiFi password, WiFi always on, inverting sensors with no sanity checks) but this is how it was designed to work, it is officially documented as doing so. I guess it boils down to a definition of the term "bug." But I feel like a lot of the knee-jerk responses (and voting) didn't read the article carefully enough. It is a core design weakness rather than a "bug" (implying an error) in an actual good design. I think the distinction is subtle but it is there. [0] https://www.tesla.com/support/energy/powerwall/own/monitoring-from-home-network https://www.tesla.com/support/energy/powerwall/own/monitorin... [1] http://azmag.gov/Portals/0/Documents/MagContent/Tesla_Powerwall%202_AC_Utility_Documentation.pdf?ver=2018-02-22-161139-873 http://azmag.gov/Portals/0/Documents/MagContent/Tesla_Powerw...
    - JaRail 7y ago
      Not having any limits on that invert setting is definitely a security/safety bug. The password is a level of incompetence beyond what you'd call a bug. It's clearly following a design decision that was imposed by someone with zero security experience.
  - AnthonyMouse 7y ago
    It's not clear that most of this is even "unintended behavior" rather than just abuse. It's like calling it a "hack" to fill water balloons with electrically conductive fluid and throw them at a substation. The people responsible for stopping you from doing that are the police, not the makers of water balloons. The worst thing they did was the default password.
- mlindner 7y ago
  Nonsense. You can twist any bug into "irresponsible behavior".
FireBeyond 7y ago
"Responsible disclosure" is an invention of vendors who want you conforming to their policies and timelines (and more). Tesla is also "good" at disabling aspects of people's property (like ethernet ports, or ability to receive future firmware updates) when they dislike what people find "wrong" or otherwise in Tesla software.
- zamadatix 7y ago
  You're always welcome to disclose to the company and follow your own timelines and policies. Presumably this doesn't change whether you tell the company first or post it on your GitHub. Shitty either way but irrelevant.
- corndoge 7y ago
  You can do responsible disclosure without following a vendor's timeline. Project Zero comes to mind. It's not like the only options are either dropping 0 days or doing exactly as the vendor says. Simply give a date. At the end of the day the point of security research is to make things more secure. Oftentimes that is best achieved by working with the vendor.
- kortilla 7y ago
  > "Responsible disclosure" is an invention of vendors who want you conforming to their policies and timeline No it’s not. It’s an invention of ethical hackers and academic security researchers who are mature enough to realize that dropping 0-days to the public is worse for society than giving the vendor a reasonable opportunity to fix it. “Economics of information security” is a field that publishes some studies about vulnerability disclosure strategies and maximizing the social good.
  - FireBeyond 7y ago
    Some interesting commentary: https://news.ycombinator.com/item?id=14010010 https://news.ycombinator.com/item?id=14010010 https://news.ycombinator.com/item?id=12308246 https://news.ycombinator.com/item?id=12308246 > That may feel good to say, but as someone whose job it was to find these kinds of bugs in software from companies ranging from tiny startups to financial exchanges to major tech vendors, this is a kind of carelessness shared by virtually everyone shipping any kind of software anywhere. > That said, the term "responsible disclosure" is Orwellian, and you should very much avoid using it. > It's coercive. It redefines language to make any handling of vulnerabilities not condoned by the vendors who shipped those vulnerabilities "irresponsible", despite the fact that third parties who discover vulnerabilities have no formal duty to cooperate with those vendors whatsoever. > The better term is "coordinated disclosure". But uncoordinated disclosure is not intrinsically irresponsible. For instance: if you know there's an exploit in the wild for something, perhaps go ahead and tweet the vulnerability without notice!
setr 7y ago
This doesn't really even seem like much of a disclosure to be had. The system is mostly open without authentication, and what little auth exists is behind a trivial-to-break password. I mean hell, the main "hack" is looking at the API calls.
simion314 7y ago
>this is pretty irresponsible disclosure. This is what corporations claim, an example that makes you think about the "irresponsibility" of disclosure is the Intel security bugs, Intel sits quiet for 1 year (and more if it's bribe would have worked) and customers are tricked to buy insecure products. As a possible future customer you would like to know that something is insecure before you buy it , keeping it hidden will just increase the number of affected people.
- dfabulich 7y ago
  You're worried about future customers, but what about Tesla's existing customers? For their sake, researchers should at least give the company a chance to respond and fix the issue before public disclosure. I agree that a year is too long. I think 30 days is about right, but it depends on how fast the product is selling, how many new customers might be harmed during the 30-day period vs. how many existing customers there are. How many customers do you think have already purchased a PowerWall, vs. how many would have purchased in the next 30 days?
  - simion314 7y ago
    I would agree if and only if is a super hard to find issue, but if any curious teenager can find and abuse this then keeping is secret is making more harm. If your car had a bug where it could be controlled remotely by any teenager with a laptop and a program do you want to know and stop using the car or block it's internet connection or prefer Tesla has it's 90 days to find a fix. Anyway let's see what harm comes from this being revealed and maybe I will change my mind.
raven105x 7y ago
Irresponsible disclosure is releasing products and services with flaws like these onto the open market - the rest is corporate doublespeak.
newnewpdro 7y ago
These issues seem fairly obvious to me. Anyone interested in powerwall vulnerabilities would find them trivially. In this case I think the value is in embarrassing Tesla for their gross negligence so they do better in this area before shipping. When you disclose such things quietly with the vendor, it mostly just saves their face. Not everyone values saving Tesla's face.
- CivBase 7y ago
  > Anyone interested in powerwall vulnerabilities would find them trivially. What about those who become invested in powerwall vulnerabilities because they read an article on HN that showed how easy it is? > When you disclose such things quietly with the vendor, it mostly just saves their face. I don't see how. They still get put on blast for ever being vulnerable in the first place. If you're goal is to get them in more trouble at the expense of their consumers, then that seems like pretty irresponsible disclosure to me. > Not everyone values saving Tesla's face. And not everyone cares one way or another about Tesla. This is about responsible disclosure. It's about protecting the consumers. It has nothing to do with the vendor.
- marvin 7y ago
  It can also give you a five- or six-figure payout and prevent unsuspecting customers of being hit by a disrupting and damaging attack, causing unnecessary economic damage. IMHO, choosing the priority of embarrassing someone rather than give them a 24-hour window of notice to avoid this would be a shitty move. This should be short-term trivially fixable by pushing a password update that sets unique passwords based on a SN -> password mapping stored in a DB at the vendor. You don't need more than 24 hours to do that.
  - FeepingCreature 7y ago
    Not like they couldn't have done that before now.
peteradio 7y ago
What is the bug exactly? Its not like there is some complex sequence to trigger any of this shit, its just sitting there because it's a terrible unsafe design. This is more of a critique of design than any zero day bug post. This is all in the goddamn manual.
sneak 7y ago
There is no such thing as irresponsible disclosure. You are allowed and encouraged to publish your security research WHENEVER YOU FEEL LIKE. The term “responsible disclosure” is a shady tactic to frame publishing immediately and in full to those affected by the vulnerability as irresponsible. It is not.
- CivBase 7y ago
  > The term “responsible disclosure” is a shady tactic to frame publishing immediately and in full to those affected by the vulnerability as irresponsible. It is not. What? Have you even tried to understand what responsible disclosure is? It is about giving the vendor a chance to protect their consumers before teaching the public how to exploit a vulnerability. The vendor still gets put on blast when the vulnerability is eventually disclosed. But at least there is less risk of the vulnerability being exploited in the mean time. And if the vendor doesn't fix the vulnerability in a reasonable time frame, they get extra blast. We've seen this happen many times. The recent Valve and Intel incidents stand out to me as good examples.
  - sneak 7y ago
    The vendor’s existence and actions are irrelevant to whether or not it’s okay to publish your research at any time. It is never irresponsible to disclose one’s research in public, in full. Vendors don’t factor in to it at all.
    - HereBeBeasties 7y ago
      Their customers do, though, and that's the whole point. Without giving people a short, reasonable time to patch, you're part of the problem, not part of the solution. For what it's worth, you are also coming across as something of a zealot, rather than a reasonable person who sees the world in shades of grey.
      - sneak 7y ago
        The burden of proof lies with the person who says publishing research and making it immediately available to those it directly affects is irresponsible. It is not. The side effect that it is available to attackers is also irrelevant to the determination of whether or not it’s irresponsible; it also becomes available to the vendor who shipped it. This notion of “you have to give the vendor time to patch xor you are irresponsible” is itself bogus. The vendor releasing the patch (prior to publication of the paper) is just as much a drop of the 0day as publishing the paper is.
bildung 7y ago
> If not, this is pretty irresponsible disclosure. Tesla was the institution that irresponsibly shipped broken hardware. Don't shoot the messenger.

nemosaltat 7y ago

Can’t believe Tesla would ship something with anything resembling a default password. At first glance, I assumed this would be a clear violation of the requirements of CA SB-327 (goes into effect Jan 1). Reread the bill, and it actually says: “The preprogrammed password is unique to each device manufactured.” If the default is based on the serial number, I guess it’s “unique” under the letter, but certainly not the spirit. Link to bill: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

jolmg 7y ago
Reminds me of a time when an ISP would provide their customers routers where their default Wifi passwords could be derived from their SSIDs. A free app would allow you to connect instantly to practically any Wifi network in the city.
- gpm 7y ago
  An ISP around here still ships consumer routers with passwords consisting of a random 8 digit hex number, i.e. that could be cracked in a day on a GTX 970m (tested hash rate against my parent's wifi). They also ship with default SSIDs, numbered 100 to 999, so given 900 GPU days of precomputation you could create rainbow tables that allow for cracking every default password/ssid pair. I can tell you from the wifi passwords I have been given by friends that many people are not changing them. At least you need to capture a handshake to use your rainbow table...
  - SECProto 7y ago
    > They also ship with default SSIDs, numbered 100 to 999, so given 899 GPU days of precomputation That would be 900 GPU days actually - off by one error
    - deleted 7y ago
      [deleted]
    - 7y ago

joeraut 7y ago

I'm amazed Tesla went ahead and used easily guessable and unchangeable passwords. It's just such a trivial and obvious issue that it seems strange Tesla engineers let this happen. I wonder if this was an off-the-shelf solution they're using here, or was developed by external contractors, for lack of a better explanation.

propercoil 7y ago

So many people like to nitpick when it comes to Tesla, It reminds me of the Apple critics in the early days of the iphone. They assume Tesla should have the highest standard and be absolutely impeccable with all their products. Just don't buy it if you don't like it. Let the rest of us enjoy a sustainable future with insanely safe full self-driving electric cars.

ajross 7y ago
This is absolutely true, and the blog post itself definitely has a little of that "picking on Tesla" vibe. And I think it's unfair too. But at the same time, this is pretty genuinely bad security architecture, and it really needs to be exposed and embarrass the company that did it. Tesla does some great stuff. This thing seems a little mailed-in, though.
loeg 7y ago
The first iphone doesn't self-propel itself to 60+ mph nor was it capable of remotely damaging critical electric infrastructure. It was a toy. When you're working in higher risk domains, higher safety standards are reasonably demanded.
JaRail 7y ago
> Just don't buy it if you don't like it. You say that about a security issue that could blow California's power grid in minutes.
- yellowapple 7y ago
  In fairness, so could a strong breeze, apparently. Thanks, PG&E!
  - JaRail 7y ago
    Alright, I'll admit you made me laugh :D
astronautjones 7y ago
this is an exploit that allows an attacker to disrupt the electrical grid - even if it's only to the substation, that effects all of your neighbors that didn't encourage you to blindly support Tesla's endeavour. it's highly irresponsible to have this kind of control behind such a trivial login on something that connects to your power lines, something extremely dangerous. far from a "nitpick"

xoa 7y ago

I have a couple of PW2s installed, connected via ethernet only (isolated on its own VLAN, though Tesla is total garbage about basics like "what firewall rules are needed"), no cellular here either. But the TEG-$(SERIAL){3} network has always been right there anyway, which is just really lazy design. I happen to be physically far enough away from anyone else that it's very unlikely to be a security issue in practice, but it's still unnecessarily polluting WiFi even beyond that. This has been noticeable for a long time too, it's not hard to find threads going back a long ways with people asking how to disable the gateway WiFi, ie., ( https://teslamotorsclub.com/tmc/threads/disable-gateway-wifi.157212/ https://teslamotorsclub.com/tmc/threads/disable-gateway-wifi... ), or people speculating about the obvious vuln/interference implications. From that thread back in June: >It would be nice to find a way to turn off the TBG's WiFi hotspot. I already have too many WiFi hotspots in my area for my taste. TBG's broadcasting WiFi is just a exploit waiting to happen. The whole thing is genuinely perplexing. Dependence on WiFi, while regrettable, I guess can sometimes make sense from a "user friendly" perspective for a lot of typical consumer installed gear. But the PowerWalls are absolutely not consumer installable, nor obviously in any way inherently wireless. They represent serious electrical infrastructure, and require professional installation with a lot of run cable. Adding in some shielded cat 5 or whatever along with that is frankly trivial for multi-thousand/ten-thousand dollar professional projects, even when not dealing with people who can do a drop themselves. Minimizing attack area is really trivial security, and here it's got other bonuses like just being more reliable. The entire IOT space is full of shit of course, but it seems much stranger in this instance to me than something like lightbulbs. And why even have passwords at all for access versus using keys? None of this is supposed to be generally accessible anyway. It's not like this would cost Tesla anything extra. Edit to add: HOSTNAME INCLUDES THE FULL SERIAL. I thought I'd take a second look at this and just pulled up the client info for the PW2 Gateway on my network, and hostname is 11XXXXX-00-J--S$(SERIAL). So no local physical access is required, the gateway itself just broadcasts the whole serial, which in light of this is an, interesting, decision. I can confirm that using the hostname with an added S at the front (so on mine serial was T[...], I used the password ST[...]) I was able to connect to the WiFi spot, and in turn to the management page described. Incredible. Incidentally DPI is also kind of wacky now that I look, just running a simple Suricata setup but connections are all over the place (why is YouTube showing up?). About 4.5 GB down and 9 GB up, down I assume would be updates of some kind, up monitoring data though that seems like a significant amount for what should generally be text. I haven't had it that long, must be kind of chatty.

JaRail 7y ago

This is an amazing lack of security best practices. To me, this screams outsourced. Given how many people hate Tesla, they need to be taking this seriously. This truly blows me away. This is "people should be fired" levels of organizational incompetence. There's no way some of these issues haven't already been noticed and put in the issue tracker. They're just not taking it seriously. It reminds me of Boeing to be perfectly honest.

morpheuskafka 7y ago
And not just fired for this, but because they are incompetent enough to do something like this in the first place. And that needs to be at however high of a level it was that approved the security plan for this product.
dogecoinbase 7y ago
It does not strike me as outsourced, given what we know about software engineering practices at Tesla: https://twitter.com/atomicthumbs/status/1032939617404645376 https://twitter.com/atomicthumbs/status/1032939617404645376
- xedeon 7y ago
  Yeah, some random Twitter account that was never substantiated. Fact: He never provided proof he is who he said he was.

vermilingua 7y ago

This is the mythical power-grid attack that people have been talking about since the concept of cyber-warfare was first dreamt up. It’s lucky we caught this now, before there are enough PowerWalls to seriously destabilise the grid if this attack were to occur.

chance_state 7y ago
> This is the mythical power-grid attack that people have been talking about since the concept of cyber-warfare was first dreamt up. > It’s lucky we caught this now, before there are enough PowerWalls to seriously destabilise the grid if this attack were to occur. I could be misunderstanding you, but do you seriously think that there are not more destabilizing attacks already available? From my reading the US power grid is already extremely vulnerable to attack.
- rmgraham 7y ago
  I think the observation being made was that this is at the scary intersection of consumer IoT non-security and major infrastructure.
- londons_explore 7y ago
  Any power grid is very vulnerable to attack. Anyone who can cause a sudden surge in demand can take a power grid down. If you can make power usage unexpectedly go up by more than ~10% within a minute, most power grids will fail. I'm struggling to think of any companies who could do that though... Someone with malicious access to teslas servers couldn't even do that... For example, instruct all plugged in tesla cars to start charging all at once. Assume 400k tesla cars are plugged in overnight, with an average 10kw charge ability. That means tesla could add 4 gigawatts to the grid demand instantly, which is only 0.4% of the USA's ~1TW generation capacity.
  - cesarb 7y ago
    > If you can make power usage unexpectedly go up by more than ~10% within a minute, most power grids will fail. Wouldn't that behave identically to a sudden loss of generation? The power grids I know of have schemes to deal with that, by automatically shedding large blocks of load in several stages.

londons_explore 7y ago

The only bug here is the default password. After authentication, the fact you can make it charge or dump power into the grid is by design. If I wanted the grid to suffer, I can do this by plugging in and unplugging a multi-kilowatt heater every few milliseconds too. Residential properties have a fuse (usually 60-100Amps), and anything you can do without blowing that fuse won't damage the grid.

Proven 7y ago
No it's not, it's also the CT Sensor. What a garbage product.
- londons_explore 7y ago
  In the same way a printer is a garbage product for printing a document landscape when you put the paper in the wrong way round? Product works in safe but unexpected ways when not configured according to reality. News at 10.
reitzensteinm 7y ago
The fast switching ability isn't a bug by itself, but it makes the insecure authentication much worse. Shitty IOT auth does not mix with power electronics. Whether Tesla is worse than other providers in this space is another question, and may well have a depressing answer.
- jacobush 7y ago
  The fast switching is still a failure of defence in depth. It could be internally rate limited to some value (which I don't know), and also with some random backoff value so Powerwalls could not be synchronised.
malux85 7y ago
You don’t see any difference between an individual switching a multi-kilowatt heater every few milliseconds vs a malicious actor automating this attack on 100,000 properties over an entire state?

lgats 7y ago

Does anyone have the FCC ID information for a Tesla PowerWall?

vpskalasatama 7y ago

Why does this seem like: "Look at me I am German, I am better than Elon Musk" Just look at Bosch&Siemens&VW

rsync 7y ago

Is there an alternative to the powerwall that is functionally similar, in terms of power density and utility, but doesn't have things like a network stack and other wifi / IoT / "smart" features ? We are just about to install lithium battery backups in our home and, of course, the Tesla powerwalls are an obvious choice, but I don't look forward to having to disable/reenable the network connectivity on them, manually, in some cat-and-mouse with Tesla for updates or whatever... In fact, I'll bet that most (all ?) of the updates that Tesla has to send the powerwalls are for the update system, and accompanying network stack, itself ...

mattmaroon 7y ago
Nothing close in terms of cost per kwh.
obilecantrem 7y ago
Used Nissan leafs are pretty affordable, might make a nice powerwall.
peteradio 7y ago
What is the reason you can't store excess on the grid?
- marvin 7y ago
  Punitive pricing, or at best you're at the mercy of the grid operators and power companies.
Nanzikambe 7y ago
Yes, I'm in France, I contacted the Italian reseller for this company: https://www.freedomwon.co.za/ https://www.freedomwon.co.za/ I got this instead of a powerwall because 1) price per kwh 2) tesla will not let you install your own powerwall, you need to go through an installer and attract all those associated costs (which are significant) 3) better integration with a mixed solar equipment install and pv array 4) powerwall does not support an offgrid installation, or at least did not when I looked into it 5) has canbus to a BMS, you're never obligated to connect to the internet

morpheuskafka 7y ago

The password configs are clearly documented: https://www.tesla.com/support/energy/powerwall/own/monitoring-from-home-network https://www.tesla.com/support/energy/powerwall/own/monitorin...

713233eb 7y ago
> Step 3: Select your home Wi-Fi network and enter your Password. So an attacker can even get LAN access from across the street.

mtgx 7y ago

Makes you wonder if you can trust their "self-driving cars" not to be remotely hacked, doesn't it?

marvin 7y ago

The criticism of this security vulnerability has been well covered at this point, so I'd just like to point out that this should be trivially solvable in a few hours by changing all passwords from HQ. It'd be quite irresponsible of this researcher if they didn't give notice beforehand (don't know if they have).

unnouinceput 7y ago

"The PW can store up to 13.5kW of electric power..." No, you store energy, not electric power, and energy is Wh, that's why you have your phone battery with 5V and 8000 mAh as units and not 8A. "How does the grid feel about me oscilating this and who will die first, the PW or the sub-station?" Definitely the PW. Sub-stations are made to withstand thousand of households switching all at once their light-bulbs at evening and during storms nature electric discharge (ie, lightning strikes). Your measly PW is fully ignored. "Do not try any of these Grid Codes (really, please do not): AU ASS4777.2 DE VDE4105 UK GA59 21A, GA83 16A IT CEI-021 NZ NZS47772 US: IEEE1547 Split Phase 240V 60Hz " I'm a bad boy, I tried them. Nothing happened.

nexuist 7y ago
If you were to try this and somehow cause damage to the sub station, would you be held liable? Actually, this brings an interesting question with IoT - if devices damage or otherwise exploit your utility company’s equipment, is it their fault of yours? Presumably doing anything bad is against your utility’s ToS, but if you didn’t do it knowingly...
- mbreese 7y ago
  I would imagine that unless you were a licensed electrician, you would be liable.
  - KMnO4 7y ago
    I’m sure you’d still be liable if you were a licensed electrician.
- unnouinceput 7y ago
  Those are commands for your PW, not for sub-station. Like I said, I tried them, and nothing happened. The author is an alarmist and the only valid point he had in the entire article was default password instead of assigning unique one, which is easily to re-configure. Also the last one I suspect might damage your PW ugly enough if you're in US, but I am in EU where I already have 240V, so ¯\_(ツ)_/¯

whattheactualf 7y ago

This is a far cry from a 'hack'. Oof.

chriscappuccio 7y ago

As I'm reading comments here I can't help but remember that Elon Musk was restrained at PayPal from switching the company's server platform from Linux to Windows. It wasn't until Microsoft tried converting Hotmail from FreeBSD to Windows (and failed, and then overhauled Windows) that Windows Server was both fast and reliable enough to be used in this way. Security review for products like this requires a real world appetite for testing. Switching PayPal from Linux to Windows requires testing. The bulletproof glass on the cybertruck obviously should have first undergone testing...