7 ms·

Can’t believe Tesla would ship something with anything resembling a default password. At first glance, I assumed this would be a clear violation of the requirem

Can’t believe Tesla would ship something with anything resembling a default password. At first glance, I assumed this would be a clear violation of the requirements of CA SB-327 (goes into effect Jan 1). Reread the bill, and it actually says: “The preprogrammed password is unique to each device manufactured.” If the default is based on the serial number, I guess it’s “unique” under the letter, but certainly not the spirit. Link to bill: https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327 https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

jolmg 7y ago
Reminds me of a time when an ISP would provide their customers routers where their default Wifi passwords could be derived from their SSIDs. A free app would allow you to connect instantly to practically any Wifi network in the city.
- gpm 7y ago
  An ISP around here still ships consumer routers with passwords consisting of a random 8 digit hex number, i.e. that could be cracked in a day on a GTX 970m (tested hash rate against my parent's wifi). They also ship with default SSIDs, numbered 100 to 999, so given 900 GPU days of precomputation you could create rainbow tables that allow for cracking every default password/ssid pair. I can tell you from the wifi passwords I have been given by friends that many people are not changing them. At least you need to capture a handshake to use your rainbow table...
  - SECProto 7y ago
    > They also ship with default SSIDs, numbered 100 to 999, so given 899 GPU days of precomputation That would be 900 GPU days actually - off by one error
    - deleted 7y ago
      [deleted]
    - gpm 7y ago
      Thanks, fixed.
- reaperducer 7y ago
  The router from my cable ISP has admin:admin. So do all of the neighbors that I can sniff.
- ProZsolt 7y ago
  If anyone wondering https://github.com/ProZsolt/upc-keys https://github.com/ProZsolt/upc-keys
randyrand 7y ago
Umm, why would a wall battery even need a password???
- filoleg 7y ago
  Because you might want to control it from your phone or laptop .
  - nemosaltat 7y ago
    And so might anyone in WiFi range apparently.
    - filoleg 7y ago
      Well, not when the security issue is fixed. Being able to do the things I described is not dependent on the existence of that security issue, ya know.
kortilla 7y ago
I disagree. The spirit of the law is to ensure that logins cannot be automated. Unless the serial number can be read over the internet without authentication, using it is completely within the spirit of the law.
- dreamcompiler 7y ago
  TFA makes it clear that the SSID is derived from the serial number and the SSID is being broadcast openly.
  - nemosaltat 7y ago
    Exactly. If the SSID was “Password=BSSID MAC” and the password _was_ the MAC address of the BSSID device, I suppose it would technically be unique. This is barely more secure than that, IMO.
- tedivm 7y ago
  The password format is `ST<YY><L>0001<XYZ>`. * YY is a year, with the first year being 2015. So right now there's only five options. * L is the revision, of which there is D, E, F, G, H, I- for six options total. * XYZ is literally the last three digits of the SSID, which means you get that for free. With all of this information it will take at most 30 attempts to log into the network.
  - dpkonofa 7y ago
    Yes, but the only time that this would be an issue is if someone, somehow decides to install it themselves or the Tesla technicians installing it forget to change the password which is very unlikely considering it's part of the standard process that you have to sign for upon install. You have to choose your own password either way or accept that you didn't.
    - tooop 7y ago
      "The password can not be changed. It is not possible to disable the WiFi network." You can only change the password for management portal not the WiFi.
sorenjan 7y ago
I guess you haven't seen this then. https://www.reddit.com/r/EnoughMuskSpam/comments/99sbwa/former_tesla_programmers_anecdotes_about_problems/ https://www.reddit.com/r/EnoughMuskSpam/comments/99sbwa/form...
- ncmncm 7y ago
  This is amazing. It is all completely plausible, and clearly includes only the most easily explained horrors, with anything that would require explanation just omitted. It is worse than I would have been able to invent.
  - marvin 7y ago
    IMHO, these stories aren’t unexpected from a tech company that grows 80% year over year, developing and expanding as fast as technology and market forces allow. Yes, there are mistakes and unfortunate incidents in the organization of people and tech priorities here, but this is inevitable in an engineering org that moves this fast. You really need to measure this up against Tesla’s achievements: Growing high double digits each year for more than a decade in a brutally competitve space, developed 4 hugely successful vehicles, first US auto company to succeed (knock on wood) or grow to significant size (>700,000 cars sold) since Ford, production constrained continuously, did this with almost zero paid marketing, built global networks of dealers, service and chargers, improved the state of battery tech by a multiple and doubled global li-ion battery pack output, built 3 car factories, made electric cars economically viable, incidentally seriously wounded the car dealership model, succeeded with qualitatively different software approach with OTA updates and tight software integration, designed cars with hitherto unparalleled performance in their class, and others that I couldn’t come up with on the spot. This is only controversial because this is safety-critical tech and it’s uncomfortable to see the development pains of consumer grade software affect it. There’s no evidence that the approach have led to more injuries or deaths than cars do in general, quite the opposite. Tesla cars are safer than competition, the argument can be made that fast deployment is a net win regarding safety. Even in the absence of any other things they have achieved. I believe there’s also an element of envy, or misunderstood beliefs that the best tech approach is taking things slowly. Yes, in isolation. But then market forces will crush you because someone else was faster, or because you missed the window of opportunity for making things so dramatically better that you manage to unbalance the local maximum of the status quo. [Edit: To everyone who downvotes this: For the sake of enlightening discussion, could you please express your disagreement in words rather than the downvote button? Note that I'm talking about GP's linked commentary on Tesla's engineering mishaps in general, not this specific vulnerability].

jolmg 7y ago

Reminds me of a time when an ISP would provide their customers routers where their default Wifi passwords could be derived from their SSIDs. A free app would allow you to connect instantly to practically any Wifi network in the city.

gpm 7y ago
An ISP around here still ships consumer routers with passwords consisting of a random 8 digit hex number, i.e. that could be cracked in a day on a GTX 970m (tested hash rate against my parent's wifi). They also ship with default SSIDs, numbered 100 to 999, so given 900 GPU days of precomputation you could create rainbow tables that allow for cracking every default password/ssid pair. I can tell you from the wifi passwords I have been given by friends that many people are not changing them. At least you need to capture a handshake to use your rainbow table...
- SECProto 7y ago
  > They also ship with default SSIDs, numbered 100 to 999, so given 899 GPU days of precomputation That would be 900 GPU days actually - off by one error
  - deleted 7y ago
    [deleted]
  - gpm 7y ago
    Thanks, fixed.
reaperducer 7y ago
The router from my cable ISP has admin:admin. So do all of the neighbors that I can sniff.
ProZsolt 7y ago
If anyone wondering https://github.com/ProZsolt/upc-keys https://github.com/ProZsolt/upc-keys

randyrand 7y ago

Umm, why would a wall battery even need a password???

filoleg 7y ago
Because you might want to control it from your phone or laptop .
- nemosaltat 7y ago
  And so might anyone in WiFi range apparently.
  - filoleg 7y ago
    Well, not when the security issue is fixed. Being able to do the things I described is not dependent on the existence of that security issue, ya know.

kortilla 7y ago

I disagree. The spirit of the law is to ensure that logins cannot be automated. Unless the serial number can be read over the internet without authentication, using it is completely within the spirit of the law.

dreamcompiler 7y ago
TFA makes it clear that the SSID is derived from the serial number and the SSID is being broadcast openly.
- nemosaltat 7y ago
  Exactly. If the SSID was “Password=BSSID MAC” and the password _was_ the MAC address of the BSSID device, I suppose it would technically be unique. This is barely more secure than that, IMO.
tedivm 7y ago
The password format is `ST<YY><L>0001<XYZ>`. * YY is a year, with the first year being 2015. So right now there's only five options. * L is the revision, of which there is D, E, F, G, H, I- for six options total. * XYZ is literally the last three digits of the SSID, which means you get that for free. With all of this information it will take at most 30 attempts to log into the network.
- dpkonofa 7y ago
  Yes, but the only time that this would be an issue is if someone, somehow decides to install it themselves or the Tesla technicians installing it forget to change the password which is very unlikely considering it's part of the standard process that you have to sign for upon install. You have to choose your own password either way or accept that you didn't.
  - tooop 7y ago
    "The password can not be changed. It is not possible to disable the WiFi network." You can only change the password for management portal not the WiFi.

sorenjan 7y ago

I guess you haven't seen this then. https://www.reddit.com/r/EnoughMuskSpam/comments/99sbwa/former_tesla_programmers_anecdotes_about_problems/ https://www.reddit.com/r/EnoughMuskSpam/comments/99sbwa/form...

ncmncm 7y ago
This is amazing. It is all completely plausible, and clearly includes only the most easily explained horrors, with anything that would require explanation just omitted. It is worse than I would have been able to invent.
- marvin 7y ago
  IMHO, these stories aren’t unexpected from a tech company that grows 80% year over year, developing and expanding as fast as technology and market forces allow. Yes, there are mistakes and unfortunate incidents in the organization of people and tech priorities here, but this is inevitable in an engineering org that moves this fast. You really need to measure this up against Tesla’s achievements: Growing high double digits each year for more than a decade in a brutally competitve space, developed 4 hugely successful vehicles, first US auto company to succeed (knock on wood) or grow to significant size (>700,000 cars sold) since Ford, production constrained continuously, did this with almost zero paid marketing, built global networks of dealers, service and chargers, improved the state of battery tech by a multiple and doubled global li-ion battery pack output, built 3 car factories, made electric cars economically viable, incidentally seriously wounded the car dealership model, succeeded with qualitatively different software approach with OTA updates and tight software integration, designed cars with hitherto unparalleled performance in their class, and others that I couldn’t come up with on the spot. This is only controversial because this is safety-critical tech and it’s uncomfortable to see the development pains of consumer grade software affect it. There’s no evidence that the approach have led to more injuries or deaths than cars do in general, quite the opposite. Tesla cars are safer than competition, the argument can be made that fast deployment is a net win regarding safety. Even in the absence of any other things they have achieved. I believe there’s also an element of envy, or misunderstood beliefs that the best tech approach is taking things slowly. Yes, in isolation. But then market forces will crush you because someone else was faster, or because you missed the window of opportunity for making things so dramatically better that you manage to unbalance the local maximum of the status quo. [Edit: To everyone who downvotes this: For the sake of enlightening discussion, could you please express your disagreement in words rather than the downvote button? Note that I'm talking about GP's linked commentary on Tesla's engineering mishaps in general, not this specific vulnerability].