4 ms·

There are many 10+ year old linux kernels in embedded devices all over the place, and much less secure systems and services on top of that. It's often called th

There are many 10+ year old linux kernels in embedded devices all over the place, and much less secure systems and services on top of that. It's often called the internet of shitty things.

cjbprime 7y ago
Right, but it's surprising that Tesla would be one of those vendors since they have an ongoing obligation to the security of their devices. It looks like their open source disclosure of the kernel source is a 4.4 kernel, so something weird is going on there. Maybe they got off 2.6 since the time the vulnerability was discovered? I see something saying they moved to 4.4 in the 8.1 update in June 2017, which is confusing because it suggests the vulnerability was never live. But I also see they have multiple CPUs running Linux and don't update the kernel on all of them at the same time, so perhaps the CPU running the 8686 driver wasn't updated?
- deleted 7y ago
  [deleted]
- stopads 7y ago
  A former Tesla software engineer posted a thread on twitter a few months ago describing their development/release process and it was a total mess of hacky bad practices that barely worked at all. It does not seem like software is much of a priority for them.
  - erikpukinskis 7y ago
    Obviously delivering cars is their priority. I’m not sure what else you would expect?
    - stopads 7y ago
      Well they are pretending to be a tech company to wall street and consumers, so someone is lying.
      - dlgeek 7y ago
        Many (major) tech companies have just as bad internal engineering infrastructure.
        opless 7y ago
        What's worse is they are very resistant to change. Think Banks and Windows XP. Except without Microsoft drawing a line in the sand and saying that they're no longer offering even paid support for it. If the change doesn't bring in value for the shareholders (or business) there will be no change.
siffland 7y ago
Most car manufacturers are reactive, like the Jeep hack a few years ago. Cyber Security should be on the forefront of their radar, but takes a back seat. So having outdated software is not that big of a surprise. I have a 3 year old phone that functions fine, but i might need to get a new one since it is full of security holes and no updates. I find myself conflicted since i love the technology behind the new cars, but my paranoia about the lack of security and the inability of myself to do anything about it. If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face....
- filoleg 7y ago
  >If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face.... They already do. IIRC Model 3 has about 6 external cameras and one internal one. However, the internal one is currently disabled and isn't used for anything, which is a subject to change for when they decide what to do with it and push it in an update. If you are looking for some wtf road videos, we are bound to see more of them soon due to the most recent update Tesla pushed. It added the "save on honk" option, which (if enabled) saves some footage right before the honk, as well as about 5 seconds after the honk. With how much spicy footage the sentry mode update has provided in less than a year, I expect nothing less from the "save on honk" update. As a sidenote, it isn't as bad as it seems in terms of privacy, because all videos (on-honk ones, or manual ones, or the sentry mode accidents) only get saved locally on your HDD/SSD/usb-drive/etc (whatever you have inserted into one of the front USB ports).

There are many 10+ year old linux kernels in embedded devices all over the place, and much less secure systems and services on top of that. It's often called the internet of shitty things.

cjbprime 7y ago

Right, but it's surprising that Tesla would be one of those vendors since they have an ongoing obligation to the security of their devices. It looks like their open source disclosure of the kernel source is a 4.4 kernel, so something weird is going on there. Maybe they got off 2.6 since the time the vulnerability was discovered? I see something saying they moved to 4.4 in the 8.1 update in June 2017, which is confusing because it suggests the vulnerability was never live. But I also see they have multiple CPUs running Linux and don't update the kernel on all of them at the same time, so perhaps the CPU running the 8686 driver wasn't updated?

deleted 7y ago
[deleted]
stopads 7y ago
A former Tesla software engineer posted a thread on twitter a few months ago describing their development/release process and it was a total mess of hacky bad practices that barely worked at all. It does not seem like software is much of a priority for them.
- erikpukinskis 7y ago
  Obviously delivering cars is their priority. I’m not sure what else you would expect?
  - stopads 7y ago
    Well they are pretending to be a tech company to wall street and consumers, so someone is lying.
    - dlgeek 7y ago
      Many (major) tech companies have just as bad internal engineering infrastructure.
      - opless 7y ago
        What's worse is they are very resistant to change. Think Banks and Windows XP. Except without Microsoft drawing a line in the sand and saying that they're no longer offering even paid support for it. If the change doesn't bring in value for the shareholders (or business) there will be no change.

siffland 7y ago

Most car manufacturers are reactive, like the Jeep hack a few years ago. Cyber Security should be on the forefront of their radar, but takes a back seat. So having outdated software is not that big of a surprise. I have a 3 year old phone that functions fine, but i might need to get a new one since it is full of security holes and no updates. I find myself conflicted since i love the technology behind the new cars, but my paranoia about the lack of security and the inability of myself to do anything about it. If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face....

filoleg 7y ago
>If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face.... They already do. IIRC Model 3 has about 6 external cameras and one internal one. However, the internal one is currently disabled and isn't used for anything, which is a subject to change for when they decide what to do with it and push it in an update. If you are looking for some wtf road videos, we are bound to see more of them soon due to the most recent update Tesla pushed. It added the "save on honk" option, which (if enabled) saves some footage right before the honk, as well as about 5 seconds after the honk. With how much spicy footage the sentry mode update has provided in less than a year, I expect nothing less from the "save on honk" update. As a sidenote, it isn't as bad as it seems in terms of privacy, because all videos (on-honk ones, or manual ones, or the sentry mode accidents) only get saved locally on your HDD/SSD/usb-drive/etc (whatever you have inserted into one of the front USB ports).