> Tesla offers a “Root access program” on their bug bounty program. Researchers who find at least one valid “rooting” vulnerability will receive a permanent SSH certificate for their own car, allowing them to log in as root and continue their research further.
Pretty interesting. Sounds like Apple's Security Research Device Program[0], where you're loaned a rooted iPhone, but with a clear qualification criteria.
It strikes a nice balance, because to qualify you have to 1) show you have the skills to get root access anyway and 2) show you're willing to participate in the bug bounty program and get things patched.
I would of course love root on everything I own, but I can understand Tesla's motivation here since root for everyone would make vulnerability discovery easier for malicious actors. And if everyone had root on their Tesla, it'd be much easier to make naughty modifications that might catch the ire of regulators. (like disabling driver attentiveness checks in self-driving mode).
It feels like this is something you should get by being owner of the car, and not have to do free speculative research for the manufacturer to get it.
This is about selling tools and access. It's another profit pipeline for car OEMs.
If an athlete breaks a world record, they're likely to do it again. Even though it's incredibly hard to break a world record.
They've also revoked certificates from researchers personal cars in the past
There's just so many computers and what-not in modern cars that this is a very tall ask. You'd need a project on-par with HomeAssistant to get anywhere.
It's pretty amazing what Claude + Ghidra + knowledgable coaching can accomplish. It was basically just setting direction, setting up an incremental workflow with the right kind of documentation, and questioning some of its theories and assumptions from time to time.
I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone (specifically the things which definte the protocol to talk to the car and mapping of what various things are reported vs what they actually mean.
"Early on, the notebook computer and LCD vendors commonly used the term LVDS instead of FPD-Link when referring to their protocol, and the term LVDS has mistakenly become synonymous with Flat Panel Display Link in the video-display engineering vocabulary."
https://en.wikipedia.org/wiki/Low-voltage_differential_signa...
And eDP is a differential signal at 200 or 400 millivolts so I don't see how that's "quite incorrect". It's not "the" LVDS but it's still in the category.
So LVDS is more likely to linger in automotive displays, while in less obsolete devices it has been replaced by either eDP or by MIPI DSI (used e.g. in smartphones).
https://x.com/i/status/1722717318009041104
DM me if interested
Put a voltmeter on the battery terminals of a regular car at 2000rpm and note the voltage. You'd be surpised (the alternator can produce as high as 15V on some cars).
13-14v is normal in all 12v automotive systems as the charging voltage
So the alternator has to put out at least something higher than if it’s planning on recharging the battery after 500 to 700 amps have been pulled from it for a few seconds to start the engine.
It's a bit perplexing that those lead acid systems are referred to as "12V" systems when that figure is effectively the 0% voltage, whereas 3.7V for single Li-ion cell is the 50% voltage.
e: also, ICE transients can be in kV range, coming from ignition mechanisms. I've heard that you can literally measure engine RPM by selecting 1/dt on an oscilloscope and dividing that by cylinder count.
One minute you might be accelerating and the onboard voltage drops as the battery supplies most of electricity. Then, as you reach the crest of a hill and start engine-braking, the car frantically tries to convert all the available kinetic energy to electricity, raising the onboard voltage to quickly charge the battery.
Not understanding this sentence. Most running ICE vehicles product closer to that 14.4 than 12v. I think a standard controller would have worked fine?
of course this is just a modern interpretation. older stuff runs at 6v and some weirdo offbeat cars have a 24v/48v rail sitting around somewhere. Cop cars often had alternators that put out weird voltage ranges for certain equipment, or dual 12v for high amperage output.
"12v" in reference to anything automotive is very much a nominal reference.
That means all computers etc will work at 6v.
> That means all computers etc will work at 6v.
Not necessarily all of them. Plenty of stuff will drop out while cranking; hopefully not the computers that run the fuel injection and ignition, though.
Given the presence of the wiring schematics and the mechanical dimensions, I'm surprised that the author did not try to 3D-print the mechanical parts of the connectors, givem that the electrical parts extracted from the BMW connectors did fit.
Completely unrelated. Would be interested if you figure out how to retrofit the new adaptive shocks on performance models to the older cars. Something I would love to do if I had hobby time. I'm pretty sure they fit physically, but needs to be connected to the main computer. I likely would never touch the main computer unless I got root access. In my brain I was thinking about a separate system made with raspberry pi's.
Fwiw, mine costs $450 from Ford. Also in the US we call this a wiring harness, with the loom being the material that goes over the wires
Violet HSD Code D 4+2 Pin Female to D Female Jack Connector 6 Pin HSD LVDS High Speed DataTransmission Harness Wire LVDS Cable https://a.aliexpress.com/_EuGOh9e
And a soldering robot with a specialist a few rooms away to beam down the latest errata into physical form, at times.
Tracy Kidder just died, and Soul of a New Machine was a favorite of my formative years as an engineer. Once I started in headunit ECU development it felt very familiar to me at times.
I'm a software guy, but the gear has a lot of allure.
Hey, I just remembered my school used to have ages ago some cool power supplies (I think from Agilent?) that were very idiot proof, they had current limit with a dial that I think didn’t went over 1A or perhaps even less, and they would instantly disarm on short circuit (and indicate it with a led), and also the voltage dial I think wouldn’t go over 25V. I remember it was very big and heavy, but it survived countless students that used the lab daily.
Nowadays, is there any power supply available that is that resistant or is the recommended approach to get an used old one? Does anyone have a power supply at home that is also used by kids with a brand/model they would recommend? Thanks!
https://www.mouser.com/c/power/power-supplies/power-supplies...
AT $5k it better make me breakfast, too.
If you want that sort of reliability it will probably go towards 100$.
> A REST-like API on :8080 which returned a history of “tasks”
I am curious to know what kind of historical tasks- since it's a media control unit; does it show what kind of media was being played in the last trip? does it reveal any other info about the driver?? There might be a privacy angle here that you could exploit and share it with Tesla.
In Tesla terms, the infotainment does much more than just playing music - it has full access to the rest of the car.
I have a Model 3, but I can't say I follow the forums.. but I've never heard of screens failing -- I'm sure it happens but I think if it was common problem I'd have heard of it.
Turns out the early Model S vehicles used consumer grade LCD panels that weren’t designed for the prolonged high heat you get in a metal and glass box left outside in the sun all day.
Tesla since upgraded their vehicle screens to proper automotive-grade LCDs which are excellent.
My point is, automotive-grade hardware is higher spec than regular consumer computer hardware, hence the high prices.
As an aside, I upgraded my whole computer and screen from MCU1 to MCU2 and it was worth the upgrade.
Credit to Tesla for building a retrofit computer upgrade for old vehicles. Thats a non-trivial thing to engineer and I appreciate their effort. Other car manufacturers would prefer you were compelled to buy their latest vehicle instead.
"To promote further security research, Tesla offers security researchers the opportunity to retain root access on their infotainment system even after their reported vulnerability has been patched. In order to qualify, a researcher must send in a valid report describing a novel way to gain root access on a Tesla infotainment system. Upon confirmation, Tesla will instruct the researcher on how to use their existing root access to enable the researcher SSH feature, along with an SSH certificate for the researcher's public key (tailored to their specific hardware ID). The certificate restricts SSH access to the local diagnostic ethernet link. Tesla may renew the certificate as long as the researcher continues reporting vulnerabilities."
Very neat.
I was really surprised to read this at the end of the article -- how could someone be this deep into a project of this depth and not realize this?! Not only because all cars (...er... all vehicles) are wired this way, but also because the documentation they were referencing has plenty of detail to show this... there's even a whole picture of it (and to Tesla's credit they have amazing free docs): https://service.tesla.com/docs/Model3/ServiceManual/2024/en-...
I think this is a software guy who occasionally dips into hardware things (to hunt bugs).
There's a list of them here: https://service.tesla.com/docs/Model3/ServiceManual/2024/en-...
Not to Tesla's credit, they had to be dragged kicking and screaming into it (primarily by Massachusetts) and their right to repair legislation through a solid chunk of malicious compliance:
1. When told that they had to have a site for people to order parts, Tesla put up a site that had every single item as "Call us", including the most simple of bolts. And when a few places called, "Sorry, that's not available to you".
2. The service manual was originally only available in a few locations in MA, and had strict conditions: you had to book in advance, there was a $100 fee per booking, and you could only view the manual on premises, and could not bring electronic devices into the room with you, just pen and paper.
The docs they have are great, and who knows how their attitude would have changed over time, but they absolutely didn't want you to have it, initially.
https://www.reddit.com/r/teslamotors/comments/utivlj/tesla_s...
> This used to cost $3187.50
https://driveteslacanada.ca/news/tesla-service-manuals-free-...
> The access story has been inconsistent over the years. Tesla has opened up free access to both the service manuals and diagnostic software in the past, but that was apparently a mistake, and loopholes were quickly closed.
https://www.teslaownersonline.com/threads/tesla-service-manu...
"Always ... all free to use". Not so much. And before that, even less available.
I will grant you for number 2, there seems to be some ambiguity - some people claimed it was only if you needed to actually use their diagnostic tools, because Tesla wouldn't sell them to anyone at the time (which is also in contradiction to your "everything you need, all free, always").
Usually, for most other vehicles, the connectors are either standardized (e.g. radios, ISO 10487 [1], high-current chargers by VG 96917) or the foundation plugs, sockets and re-pinning tools are readily available by the vehicle manufacturer or by aftermarket suppliers.
Tesla truly went out of their way to make the life of third parties (such as wire harness repair shops) more miserable here.
Sounds alright until you realize after spilling a bunch of flower vases in the trunk (hatchback) that the computer has literally no case on it and immediately shorts out while driving. Or a passenger spills a drink in the rear seat cup holder.
There is now a recall notice to pull the back seat out to install a $5 plastic cover over the thing.
And yep, it’s the main computer for the car which controls the electronic transmission etc. Immediate full on engine-shuts-off at speed on the freeway and you require a flatbed to tow it away level of broken. I’m sure the engine ECU is in the engine bay, but holy hell what a surprise!
I had a small crack in the rubber seal around my sunroof from parking outside in the elements. When it rained, water seeped in, made its way down the a-pillar, pooled under the seat, and fried the computer.
Expensive fix but I was able to drive it to the shop.
Some Mazdas put the metal-cased engine computer in a plastic air box that feeds cold air from the front, to help ensure the engine computer stays cool enough.
In general, I believe the cooling airflow from the frontal air and the cooling fans keeps engine bay in check.
For example, this is the board that’s used in Mazda CX-5 2017+ engine computers (mfr Denso), it lists max temperature range of +150C: https://www.renesas.com/en/document/mah/rh850e1l-users-manua...
This thread is interesting to me 'cause I'm also a software guy and recently took a job dealing with building fighter jets and the amount of engineering going into the wiring and computers on those things is insane. It's been a very interesting learning experience.
It's also notorious for having awful solder connections and failing outright.
https://evilution.co.uk/mod/sam-unit-solder-repair.htm (and Aging Wheels: https://www.youtube.com/watch?v=n8AAleKR33Q)
Now they just have to take the next step and have everything in the vehicle running on PoE.
You should see what happens when someone involved in the sciences, e.g. Chemistry, gets their hands on Claude Code.
Their code is aways terrible, and they constantly think it's good.
The exercise is always the same: explain the math to me, like I'm 5, then we profile it and see what is faster.
Oddly Claude Code, integrated into their IDE's has made this situation happen much less.
I never want to work in a place again where the fun way to start the Monday meeting is a "math problem".
PS: Don't even get me started on their SQL.
It's like "software dude thinks he can do hardware", but on steroids. They don't know what they don't know and they think they have a panacea in their hands.
Don't you know? Software is beneath them and the fiddly bits are just standing in the way of them getting their BigImportantWork™ done.
Professionals overestimating their knowledge is a very common thing!
I was a developer for a decade before I went to school for design, so I’ve seen it from the other side. It’s not all bad: that overconfidence can lead people to tackle problems they’d abandon if they really understood the domain’s complexities. But often it presents like developers acting like their genius developer brain allows them to solve difficult problems in completely different fields with a few glib analogies and a few brief thought experiments.
I have worked with a LOT of PHD's in recent years. Their code leaves much to be desired.
As an Australian. I often find myself saying things like “the wiring hardness, or loom, or cable, or whatever were calling it this week”.
Exasperated by living in a state other than the one I grew up in. South Australians are often easily spotted by their pronunciation of certain words.
It’s just a phrase or sentence with spaces removed.
Knowhatimsayin.
https://www.3m.com/3M/en_US/p/c/electrical/wire-cable/tubing...
[1]: https://www.holley.com/products/engine/engine_dress_up/hoses... [2]: https://www.oreillyauto.com/detail/c/dorman-conduct-tite/lig...
