38 ms·

> As Linux Kernel 2.6.36 does not support NX Does the Model S really run 2.6.36, first released ten years ago? I'm sure they're using a stable branch and keepi

> As Linux Kernel 2.6.36 does not support NX Does the Model S really run 2.6.36, first released ten years ago? I'm sure they're using a stable branch and keeping up with security patches in general [1], but that's still shocking to me. [1]: although not 100% of security patches are going to end up in the stable@ queue or have their effect on 2.6.36 considered.

stopads 7y ago
There are many 10+ year old linux kernels in embedded devices all over the place, and much less secure systems and services on top of that. It's often called the internet of shitty things.
- cjbprime 7y ago
  Right, but it's surprising that Tesla would be one of those vendors since they have an ongoing obligation to the security of their devices. It looks like their open source disclosure of the kernel source is a 4.4 kernel, so something weird is going on there. Maybe they got off 2.6 since the time the vulnerability was discovered? I see something saying they moved to 4.4 in the 8.1 update in June 2017, which is confusing because it suggests the vulnerability was never live. But I also see they have multiple CPUs running Linux and don't update the kernel on all of them at the same time, so perhaps the CPU running the 8686 driver wasn't updated?
  - deleted 7y ago
    [deleted]
  - stopads 7y ago
    A former Tesla software engineer posted a thread on twitter a few months ago describing their development/release process and it was a total mess of hacky bad practices that barely worked at all. It does not seem like software is much of a priority for them.
    - erikpukinskis 7y ago
      Obviously delivering cars is their priority. I’m not sure what else you would expect?
      - stopads 7y ago
        Well they are pretending to be a tech company to wall street and consumers, so someone is lying.
        dlgeek 7y ago
        Many (major) tech companies have just as bad internal engineering infrastructure.
        opless 7y ago
        What's worse is they are very resistant to change. Think Banks and Windows XP. Except without Microsoft drawing a line in the sand and saying that they're no longer offering even paid support for it. If the change doesn't bring in value for the shareholders (or business) there will be no change.
- siffland 7y ago
  Most car manufacturers are reactive, like the Jeep hack a few years ago. Cyber Security should be on the forefront of their radar, but takes a back seat. So having outdated software is not that big of a surprise. I have a 3 year old phone that functions fine, but i might need to get a new one since it is full of security holes and no updates. I find myself conflicted since i love the technology behind the new cars, but my paranoia about the lack of security and the inability of myself to do anything about it. If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face....
  - filoleg 7y ago
    >If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face.... They already do. IIRC Model 3 has about 6 external cameras and one internal one. However, the internal one is currently disabled and isn't used for anything, which is a subject to change for when they decide what to do with it and push it in an update. If you are looking for some wtf road videos, we are bound to see more of them soon due to the most recent update Tesla pushed. It added the "save on honk" option, which (if enabled) saves some footage right before the honk, as well as about 5 seconds after the honk. With how much spicy footage the sentry mode update has provided in less than a year, I expect nothing less from the "save on honk" update. As a sidenote, it isn't as bad as it seems in terms of privacy, because all videos (on-honk ones, or manual ones, or the sentry mode accidents) only get saved locally on your HDD/SSD/usb-drive/etc (whatever you have inserted into one of the front USB ports).
slg 7y ago
It looks like a car would need to be over 2 years behind Tesla's OTA updates for it to still have version 2.6.36 and be vulnerable to this exploit. https://electrek.co/2017/06/30/tesla-new-linux-kernel-update-ui-improvements/ https://electrek.co/2017/06/30/tesla-new-linux-kernel-update... EDIT: See nils2014's comments below. The WiFi chip is connected to the entertainment system which received an updated kernel, but it is seems like the kernel on the WiFi chip itself may not have been updated.
- cjbprime 7y ago
  (Note that this article is only talking about the dashboard entertainment machine, which probably isn't the one the wifi chip's connected to. Perhaps that one got slower updates.)
- nils2014 7y ago
  The kernel version of the information center is irrelevant. The Wi-Fi stack is running on a separate module (the Parrot module, as mentioned in the article), which runs its own obsolete linux version.
  - cjbprime 7y ago
    I wonder if there's a way to find out which kernel version Parrot runs today.
    - stefan_ 7y ago
      Do they even still exist? It's impossible to find anything on these modules beyond FCC filings; some pixelated datasheets show the modules with "www.parrot.com" printed on them but going as far back as 2017 in the WWW archive, that site belongs to some drone startup.
      - cjbprime 7y ago
        What do you mean by "still exist"? Obviously a vuln was found in one that was inside a Model S, reported to Tesla and fixed.
nils2014 7y ago
> I'm sure they're using a stable branch and keeping up with security patches Surely you must be joking... The last kernel 2.6.x LTS version to be maintained is 2.6.32.71, and its maintenance ended in March 2016 [1]. No Security patches were released for 2.6.x since then. [1] https://en.wikipedia.org/wiki/Linux_kernel_version_history#Releases_2.6.x.y https://en.wikipedia.org/wiki/Linux_kernel_version_history#R...
- LinuxBender 7y ago
  You are right, but AFAIK they are running CentOS and Redhat have been back-porting security and fixes to major bugs at least until recently. CentOS 6 is in extended support phase 2 [1] Hopefully they move to CentOS 8 soon. I have no idea how this is implemented or if that parrot module has a flashable firmware. It is interesting that they say there is no support for NX. CentOS 6 which is based on the 2.6 kernel does support it. [2] That is not to say that things were compiled with the right options. [1] - https://access.redhat.com/support/policy/updates/errata https://access.redhat.com/support/policy/updates/errata [2] - https://fedoraproject.or/wiki/Security_Features_Matrix https://fedoraproject.or/wiki/Security_Features_Matrix [ EDIT ] I was advised it is not running CentOS and that may be another system in the vehicle.
  - nils2014 7y ago
    That's incorrect. The Parrot module has only 32MB RAM and is running a custom marvell buildroot-style linux distribution [1]. You're confusing the linux running on the information center, with the linux running on the Parrot board. [1] https://fccid.io/RKXFC6050W/Users-Manual/user-manual-1707044 https://fccid.io/RKXFC6050W/Users-Manual/user-manual-1707044
    - LinuxBender 7y ago
      Thankyou for the correction.
    - cjbprime 7y ago
      And the information center runs Ubuntu, not CentOS. If Parrot's still running 2.6.36, that's a really really bad sign for its security. You would have to predict more remote vulns on the way.

stopads 7y ago

There are many 10+ year old linux kernels in embedded devices all over the place, and much less secure systems and services on top of that. It's often called the internet of shitty things.

cjbprime 7y ago
Right, but it's surprising that Tesla would be one of those vendors since they have an ongoing obligation to the security of their devices. It looks like their open source disclosure of the kernel source is a 4.4 kernel, so something weird is going on there. Maybe they got off 2.6 since the time the vulnerability was discovered? I see something saying they moved to 4.4 in the 8.1 update in June 2017, which is confusing because it suggests the vulnerability was never live. But I also see they have multiple CPUs running Linux and don't update the kernel on all of them at the same time, so perhaps the CPU running the 8686 driver wasn't updated?
- deleted 7y ago
  [deleted]
- stopads 7y ago
  A former Tesla software engineer posted a thread on twitter a few months ago describing their development/release process and it was a total mess of hacky bad practices that barely worked at all. It does not seem like software is much of a priority for them.
  - erikpukinskis 7y ago
    Obviously delivering cars is their priority. I’m not sure what else you would expect?
    - stopads 7y ago
      Well they are pretending to be a tech company to wall street and consumers, so someone is lying.
      - dlgeek 7y ago
        Many (major) tech companies have just as bad internal engineering infrastructure.
        opless 7y ago
        What's worse is they are very resistant to change. Think Banks and Windows XP. Except without Microsoft drawing a line in the sand and saying that they're no longer offering even paid support for it. If the change doesn't bring in value for the shareholders (or business) there will be no change.
siffland 7y ago
Most car manufacturers are reactive, like the Jeep hack a few years ago. Cyber Security should be on the forefront of their radar, but takes a back seat. So having outdated software is not that big of a surprise. I have a 3 year old phone that functions fine, but i might need to get a new one since it is full of security holes and no updates. I find myself conflicted since i love the technology behind the new cars, but my paranoia about the lack of security and the inability of myself to do anything about it. If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face....
- filoleg 7y ago
  >If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face.... They already do. IIRC Model 3 has about 6 external cameras and one internal one. However, the internal one is currently disabled and isn't used for anything, which is a subject to change for when they decide what to do with it and push it in an update. If you are looking for some wtf road videos, we are bound to see more of them soon due to the most recent update Tesla pushed. It added the "save on honk" option, which (if enabled) saves some footage right before the honk, as well as about 5 seconds after the honk. With how much spicy footage the sentry mode update has provided in less than a year, I expect nothing less from the "save on honk" update. As a sidenote, it isn't as bad as it seems in terms of privacy, because all videos (on-honk ones, or manual ones, or the sentry mode accidents) only get saved locally on your HDD/SSD/usb-drive/etc (whatever you have inserted into one of the front USB ports).

slg 7y ago

It looks like a car would need to be over 2 years behind Tesla's OTA updates for it to still have version 2.6.36 and be vulnerable to this exploit. https://electrek.co/2017/06/30/tesla-new-linux-kernel-update-ui-improvements/ https://electrek.co/2017/06/30/tesla-new-linux-kernel-update... EDIT: See nils2014's comments below. The WiFi chip is connected to the entertainment system which received an updated kernel, but it is seems like the kernel on the WiFi chip itself may not have been updated.

cjbprime 7y ago
(Note that this article is only talking about the dashboard entertainment machine, which probably isn't the one the wifi chip's connected to. Perhaps that one got slower updates.)
nils2014 7y ago
The kernel version of the information center is irrelevant. The Wi-Fi stack is running on a separate module (the Parrot module, as mentioned in the article), which runs its own obsolete linux version.
- cjbprime 7y ago
  I wonder if there's a way to find out which kernel version Parrot runs today.
  - stefan_ 7y ago
    Do they even still exist? It's impossible to find anything on these modules beyond FCC filings; some pixelated datasheets show the modules with "www.parrot.com" printed on them but going as far back as 2017 in the WWW archive, that site belongs to some drone startup.
    - cjbprime 7y ago
      What do you mean by "still exist"? Obviously a vuln was found in one that was inside a Model S, reported to Tesla and fixed.

nils2014 7y ago

> I'm sure they're using a stable branch and keeping up with security patches Surely you must be joking... The last kernel 2.6.x LTS version to be maintained is 2.6.32.71, and its maintenance ended in March 2016 [1]. No Security patches were released for 2.6.x since then. [1] https://en.wikipedia.org/wiki/Linux_kernel_version_history#Releases_2.6.x.y https://en.wikipedia.org/wiki/Linux_kernel_version_history#R...

LinuxBender 7y ago
You are right, but AFAIK they are running CentOS and Redhat have been back-porting security and fixes to major bugs at least until recently. CentOS 6 is in extended support phase 2 [1] Hopefully they move to CentOS 8 soon. I have no idea how this is implemented or if that parrot module has a flashable firmware. It is interesting that they say there is no support for NX. CentOS 6 which is based on the 2.6 kernel does support it. [2] That is not to say that things were compiled with the right options. [1] - https://access.redhat.com/support/policy/updates/errata https://access.redhat.com/support/policy/updates/errata [2] - https://fedoraproject.or/wiki/Security_Features_Matrix https://fedoraproject.or/wiki/Security_Features_Matrix [ EDIT ] I was advised it is not running CentOS and that may be another system in the vehicle.
- nils2014 7y ago
  That's incorrect. The Parrot module has only 32MB RAM and is running a custom marvell buildroot-style linux distribution [1]. You're confusing the linux running on the information center, with the linux running on the Parrot board. [1] https://fccid.io/RKXFC6050W/Users-Manual/user-manual-1707044 https://fccid.io/RKXFC6050W/Users-Manual/user-manual-1707044
  - LinuxBender 7y ago
    Thankyou for the correction.
  - cjbprime 7y ago
    And the information center runs Ubuntu, not CentOS. If Parrot's still running 2.6.36, that's a really really bad sign for its security. You would have to predict more remote vulns on the way.