3 ms·

I've can't imagine any technical situation short of "we lost the source to the in-car software, which is pinned to a certificate only installed on our server, w

I've can't imagine any technical situation short of "we lost the source to the in-car software, which is pinned to a certificate only installed on our server, which only one guy had the password to, and he kept it only in his memory, and he died".

gjsman-1000 2y ago
Ironically, the best solution if that was the case, would be to hire some hackers and hack your own car. Find a kernel exploit, find a power glitching attack against the CPU, find a USB exploit, find a Bluetooth exploit, find a Recovery mode exploit, whatever it may be; and build a physical harness which consistently runs the exploit and modifies the signing certificate. Nasty but effective and probably cheap. Or, even, kills the main GUI and replaces it with your own. If I was American Lease, I would look into that, besides suing. Edit: Looking into it, it’s Android Automotive without Google Services. Who wants to bet that it’s an old version of Android on a recycled MediaTek tablet processor which is no longer getting security patches? Knowing MediaTek, completely reprogramming Secure Boot might not be off the table.
- jcgrillo 2y ago
  There's also the option of the ethical version of the $5 wrench hack--hiring the (recently unemployed) people who actually built this stuff.
  - gjsman-1000 2y ago
    Assuming they still have the signing keys, or knowledge of how the build servers worked… or even legal access to the source code, which would require a negotiation / lawsuit against Fisker that could take years. That’s assuming Fisker hasn’t already liquidated that material.
    - jcgrillo 2y ago
      Those are good points, but even hiring someone with knowledge as a consultant could be valuable in framing that case--knowing what you actually need is important.
      - gjsman-1000 2y ago
        Another possibility, maybe easier or more sustainable, would be to hire the employees who built the harnesses and interconnects for the car’s entertainment computer. Tell them to build a drop in Raspberry Pi-powered replacement with a custom, basic firmware that only does CarPlay or Android Auto, and call it a day. Or maybe the result is a Frankenstein creation where the original controller takes care of the driver’s dashboard display, but the entertainment display is Pi-driven.
grecy 2y ago
You’d be surprised… The last place I worked on a system that billed $5-$10 million a month, all pure profit. I was the only one with any knowledge. When the server was built the guy who did so never documented the root password, and nobody knows it. I was in the sudoers file, and I have no idea what they do since I left. I tried to explain it to multiple levels of management, but I lost them all the second I opened a terminal and ssh’d in. I can tell it’s still running…

gjsman-1000 2y ago

Ironically, the best solution if that was the case, would be to hire some hackers and hack your own car. Find a kernel exploit, find a power glitching attack against the CPU, find a USB exploit, find a Bluetooth exploit, find a Recovery mode exploit, whatever it may be; and build a physical harness which consistently runs the exploit and modifies the signing certificate. Nasty but effective and probably cheap. Or, even, kills the main GUI and replaces it with your own. If I was American Lease, I would look into that, besides suing. Edit: Looking into it, it’s Android Automotive without Google Services. Who wants to bet that it’s an old version of Android on a recycled MediaTek tablet processor which is no longer getting security patches? Knowing MediaTek, completely reprogramming Secure Boot might not be off the table.

jcgrillo 2y ago
There's also the option of the ethical version of the $5 wrench hack--hiring the (recently unemployed) people who actually built this stuff.
- gjsman-1000 2y ago
  Assuming they still have the signing keys, or knowledge of how the build servers worked… or even legal access to the source code, which would require a negotiation / lawsuit against Fisker that could take years. That’s assuming Fisker hasn’t already liquidated that material.
  - jcgrillo 2y ago
    Those are good points, but even hiring someone with knowledge as a consultant could be valuable in framing that case--knowing what you actually need is important.
    - gjsman-1000 2y ago
      Another possibility, maybe easier or more sustainable, would be to hire the employees who built the harnesses and interconnects for the car’s entertainment computer. Tell them to build a drop in Raspberry Pi-powered replacement with a custom, basic firmware that only does CarPlay or Android Auto, and call it a day. Or maybe the result is a Frankenstein creation where the original controller takes care of the driver’s dashboard display, but the entertainment display is Pi-driven.

grecy 2y ago

You’d be surprised… The last place I worked on a system that billed $5-$10 million a month, all pure profit. I was the only one with any knowledge. When the server was built the guy who did so never documented the root password, and nobody knows it. I was in the sudoers file, and I have no idea what they do since I left. I tried to explain it to multiple levels of management, but I lost them all the second I opened a terminal and ssh’d in. I can tell it’s still running…