4 ms·

To do that the attacker would need to connect to hundreds (thousands?) of Powerwalls at the same time and figure out the password for each of them. Which means

To do that the attacker would need to connect to hundreds (thousands?) of Powerwalls at the same time and figure out the password for each of them. Which means being close enough to each of them to access the Wifi and also figuring out their serial number somehow. How would they do that?

cstross 7y ago
Not feasible for a single idiot to accomplish, but you're forgetting we live in an age of State-Level Actors who distribute very sophisticated malware to attack enemy nation's infrastructure by borking SCADA controllers in e.g. uranium enrichment plants or petrochemical refineries. One may hypothesize about the feasibility of a router-targeting worm (similar to the Moon router worm, targeting Linksys kit) that has a payload that searches for nearby PowerWalls and uses its owners's resources to play guess the password. Getting in wouldn't be fast, but over a period of months such a worm could well gain control over thousands to tens of thousands of powerwalls. At which point, a DDoS attack on national-level grid infrastructure is within reach.
- wil421 7y ago
  It would be more feasible to just hack industrial controls or the power company rather than create some worm for a specific router and hope that you can find the 50k powerwalls.
  - pageandrew 7y ago
    Whats more difficult: penetrating a single hard target, or a large number of soft targets?
masklinn 7y ago
> figure out the password for each of them. Which means being close enough to each of them to access the Wifi and also figuring out their serial number somehow. How would they do that? Per TFA, the serial number is ST<AA><B>0001<CCC>. AA is the year, for which there are currently 5 values (15 to 19). B is the revision, for which there are currently 6 values (D to I). CCC is provided as part of the broadcasted SSID. So they would "do that" by enumerating and trying out the 30 possible serial numbers for each SSID. edit: apparently you may not even need to bother because the PW's hostname straight includes the entire serial: https://news.ycombinator.com/item?id=21611525 https://news.ycombinator.com/item?id=21611525
Normal_gaussian 7y ago
You don't need to be close. You just need to control a device that is. The cheap IoT light you bought, or your neighbour bought, or that crappy game app your kid downloaded, or you did (tesla mobile background maker?). As others noted the password is trivial.

cstross 7y ago

Not feasible for a single idiot to accomplish, but you're forgetting we live in an age of State-Level Actors who distribute very sophisticated malware to attack enemy nation's infrastructure by borking SCADA controllers in e.g. uranium enrichment plants or petrochemical refineries. One may hypothesize about the feasibility of a router-targeting worm (similar to the Moon router worm, targeting Linksys kit) that has a payload that searches for nearby PowerWalls and uses its owners's resources to play guess the password. Getting in wouldn't be fast, but over a period of months such a worm could well gain control over thousands to tens of thousands of powerwalls. At which point, a DDoS attack on national-level grid infrastructure is within reach.

wil421 7y ago
It would be more feasible to just hack industrial controls or the power company rather than create some worm for a specific router and hope that you can find the 50k powerwalls.
- pageandrew 7y ago
  Whats more difficult: penetrating a single hard target, or a large number of soft targets?

masklinn 7y ago

> figure out the password for each of them. Which means being close enough to each of them to access the Wifi and also figuring out their serial number somehow. How would they do that? Per TFA, the serial number is ST<AA><B>0001<CCC>. AA is the year, for which there are currently 5 values (15 to 19). B is the revision, for which there are currently 6 values (D to I). CCC is provided as part of the broadcasted SSID. So they would "do that" by enumerating and trying out the 30 possible serial numbers for each SSID. edit: apparently you may not even need to bother because the PW's hostname straight includes the entire serial: https://news.ycombinator.com/item?id=21611525 https://news.ycombinator.com/item?id=21611525

Normal_gaussian 7y ago

You don't need to be close. You just need to control a device that is. The cheap IoT light you bought, or your neighbour bought, or that crappy game app your kid downloaded, or you did (tesla mobile background maker?). As others noted the password is trivial.