Hacker News

> Researchers who find at least one valid “rooting” vulnerability will receive a permanent SSH certificate for their own car

It feels like this is something you should get by being owner of the car, and not have to do free speculative research for the manufacturer to get it.

Having shell is extremely handy for further discovery. SO handy that if they were just gonna patch the bug and lock you out, you would simply not disclose it.

If they don't give root, researcher may have incentive to keep vuln secret for root access. Looks reasonable.

It's a mixed bag. This only applies to the infotainment system and not the autopilot computer.

They've also revoked certificates from researchers personal cars in the past

That’s quite a weak confidence in their own platform security if finding a root level vulnerability is not one-off event, but it’s a program expected to have multiple people routinely finding those.

Imagine having to hack your device, then having to submit a request to actually own it.

The interesting part is this implies that Tesla cars have static certifcates that don't rotate. (Whoops.)

And as we all know, if you're smart enough to get root access, your neighbours children playing football in the street should be subject to the risk of you driven a car that claims to have full self driving with custom code on it.

Diagnostic Trouble Codes?

That's super cool, I'm currently struggling with scan tools for a 1999 Mercedes E300 Turbodiesel. I had one that worked OK for about a decade (Autel something or other) with a 38pin connector, but it recently bricked itself with a message like "connect via USB to Updata" which I assume means its firmware somehow erased itself. Cannot figure out how to "updata" it, doesn't seem to connect via USB, the Autel software runs under Wine but doesn't appear to recognize the device... gave up and bought an iCarsoft device which sorta kinda works. It can talk to every module except for the ECU (Bosch MSA 25.1 I believe?) however if I tell the device that my car is a different model (1995-1997 naturally aspirated) I can blindly clear ECU DTCs, which is good enough because this thing is barely more complicated than a toaster. All that is to say, this space is ripe for some open hardware/software love.

You don't know anything about late-90s Lucas/SAGEM GEMS ECUs do you, or Range Rover BeCMs?

I'm currently picking apart the firmware in those because it is now impossible to get replacement ignition key fobs, and it just can't be that difficult...

I spent the last week successfully reverse engineering my car / various scan tools to get the right information to diagnose a fuel pump problem (and to do so without the incredible awkwardness of many of the tools)

It's pretty amazing what Claude + Ghidra + knowledgable coaching can accomplish. It was basically just setting direction, setting up an incremental workflow with the right kind of documentation, and questioning some of its theories and assumptions from time to time.

I'd love to release a lot of it but I'm torn between releasing artifacts created with expensive software I paid for and thinking that many of those things should really be freely available to anyone (specifically the things which definte the protocol to talk to the car and mapping of what various things are reported vs what they actually mean.

Not saying there's anything wrong with your perspective (lots of terms get in muddied waters, it's common and not a problem if everyone is on the same page), but this is what I just found on Wikipedia:

"Early on, the notebook computer and LCD vendors commonly used the term LVDS instead of FPD-Link when referring to their protocol, and the term LVDS has mistakenly become synonymous with Flat Panel Display Link in the video-display engineering vocabulary."

https://en.wikipedia.org/wiki/Low-voltage_differential_signa...

LVDS with Fakra connectors is pretty standard in automotive for cameras and displays. The protocols used over it are often proprietary though.

Most modern laptops no longer use LVDS for connecting the screen, but they use eDP (embedded DisplayPort).

So LVDS is more likely to linger in automotive displays, while in less obsolete devices it has been replaced by either eDP or by MIPI DSI (used e.g. in smartphones).

SpaceWire is also just LVDS with an uber-minimal routing protocol. It runs on a lot of satellites.

>then I needed to find a brake controller that can work with the higher voltage (14.4v vs the normal 12v)

Put a voltmeter on the battery terminals of a regular car at 2000rpm and note the voltage. You'd be surpised (the alternator can produce as high as 15V on some cars).

> But then I needed to find a brake controller that can work with the higher voltage (14.4v vs the normal 12v)

Not understanding this sentence. Most running ICE vehicles product closer to that 14.4 than 12v. I think a standard controller would have worked fine?

Just put it online somewhere

He does that in the write-up, though it's unclear from the photos if he actually soldered it or just twisted up pairs. The discussion of part of the wire melting also raises an eyebrow.. no idea about the authors hardware experience, but I've seen software guys use piddly 24 AWG on a multi-amp circuit

LVDS implies differential signals and are designed to minimize EMI and can be hard to splice while still maintaining signal integrity. They can support high data rates (ethernet cables also use twisted pair LVDS). Theoretically this should be feasible up to 100s or even 1000s of mbps

From messing around with these units from various cars, which often need more enablement than these, sometimes it’s nice to just know your interpretation of the wiring diagrams isn’t at fault when chasing down “no lights at all” issues.

It's exactly the same. Why would it be different?

I work on automotive software (not Tesla), and it's like this partially because it makes development _way easier_. Rather than needing to get a whole car to the dev team, you just give them the specific part that they're working on. Anything that needs outside features usually just fails gracefully (e.g. no speedometer or no location for maps). These are usually mocked for testing, or you add the specific ECU that provides it for your testing setup if needed.

Modern cars have tens of ECUs, so if you had to have all of them for testing, that would get unwieldy extremely quickly. Not to mention that cars are pretty resilient to having random parts failing, you don't want to lose the entire dashboard just because the ECU that provides camera data failed, or something.

Yeah, I expected some gigantic writeup about tricking it into thinking all other systems are connected to it but maybe it's made this way so it's easier to repair without needing the whole car

That particular statement is also wrong. For this particular setup you can also buy the correct cable (making sure to not get the one that inverts some pins!!!) for cheaper. Mine was around 15$.

Violet HSD Code D 4+2 Pin Female to D Female Jack Connector 6 Pin HSD LVDS High Speed DataTransmission Harness Wire LVDS Cable https://a.aliexpress.com/_EuGOh9e

Parts and labor combined that would be a 4000-5000 eurobuck job. A Nissan importer tried to weasel out of a warranty replacement on a friend's X-Trail so they first offered to completely refund options that had become unusable.

The car was full of issues and probably spent more time in the shop than on the road. Nissan finally had to buy it back after service techs failed to tighten the oil drain cap after an engine overhaul.

I read somewhere that the reason they don't typically use IT networking cables / tech is because normal IT infrastructure is a lot less strict with things like packet loss. It's actually not a huge deal to drop packets here and there, especially if any given component is at capacity. But in a car, some devices are super chatty and you can't be dropping packets much at all.

That said, I'm sure there's gotta be a better way to solve it with less copper. And I think they did something like that with CyberTruck.

Cars are moving towards something like that, mostly because copper is expensive and there are miles and miles of it in even a basic car these days

Honestly I love it. Few things develop a more fun camaraderie than a bringup bootcamp with two precious/priceless new samples on a large conference table, and everyone being very careful to keep cups/mugs very far away.

And a soldering robot with a specialist a few rooms away to beam down the latest errata into physical form, at times.

Tracy Kidder just died, and Soul of a New Machine was a favorite of my formative years as an engineer. Once I started in headunit ECU development it felt very familiar to me at times.

I'm a software guy, but the gear has a lot of allure.

Can confirm. We are required to test all of our stuff on a bench, but no one really trusts this, because everything is mocked anyway (RSI).

You can, at the very least, retrofit the Juniper suspension onto the old car [1]. I haven't ridden in the new Performance yet, but I recently got a 2026 Model Y and the suspension is night and day compared to my 2024.

[1] - https://www.youtube.com/watch?v=EahoyTgkkyU

What you're describing is a lab power supply. (The "instantly disarm on short circuit" is overcurrent protection, which is a standard feature.) The name brands like Keysight or Rigol are kind of expensive, but there are a lot of no-name models on Amazon which will do the job well enough.

Those were called something like desktop power supplies.

https://www.mouser.com/c/power/power-supplies/power-supplies...

AT $5k it better make me breakfast, too.

Got this for ~50$ a while ago. It works perfectly for this exact setup (Tesla MCU on a bench), tested it, and used it for a lot of other projects.

https://a.aliexpress.com/_EvT5Kog

They have variable dc power supplies on amazon on the cheap.

If you want that sort of reliability it will probably go towards 100$.

Cell phone/laptop repair shops.

They hit Odin. Odin is the diagnostic tool of Tesla. The tasks they've seen are like "TEST_BRAKE_X_STIFFNESS-TEST-PRESSURE-BURNISHED" and are used to test different components of the car. They're also used for example to reset FSD strikes.

In Tesla terms, the infotainment does much more than just playing music - it has full access to the rest of the car.

You get the linux kernel and a bunch of other things you can find on github anyway. You can't do anything useful with that, except what you already can get from any linux package manager.

Sure someone should do it just to verify the process works, but it isn't really useful. (in general companies are very careful to not violate GPL license terms, often refusing to use GPL3 at all)

That is done to kill the "chop shops" criminals used to steal cars and then break them up for parts. You can't do that with computers because of that pairing and so stealing a car pays much less and in turn is less common. (it still happens, it just doesn't pay as well)

The trick is to pick up the main computer and the paired drive unit(s) by picking up a whole vehicle (with a salvage title). There are shops in LA, and elsewhere who do conversions this way.

I'd guess they fail not on their own, but because they are human interface devices and take the brunt of abuse... e.g. iPhone screens are a popular repair despite being reliable components.

I have a 2023 model 3 and my screen had a small defect develop, a slightly darker area in a roughly half cm diameter area. I think most people would have never noticed but I pointed it out to Tesla service and they replaced the screen.

Some newer models have better (bigger) screens, and some are incompatible since they've slightly changed the connector. Old models (pre highland/ jupiter facelift) have used the same display shown in the article for a very long time across M3 and MY. What usually happens is that they physically break because people are not that careful, so the touch screen ends up breaking - although you really have to put a lot of force to break that display.

My 2016 Model S LCD panel developed the well-known fault of delamination and leaking some kind of sticky fluid.

Turns out the early Model S vehicles used consumer grade LCD panels that weren’t designed for the prolonged high heat you get in a metal and glass box left outside in the sun all day.

Tesla since upgraded their vehicle screens to proper automotive-grade LCDs which are excellent.

My point is, automotive-grade hardware is higher spec than regular consumer computer hardware, hence the high prices.

As an aside, I upgraded my whole computer and screen from MCU1 to MCU2 and it was worth the upgrade.

Credit to Tesla for building a retrofit computer upgrade for old vehicles. Thats a non-trivial thing to engineer and I appreciate their effort. Other car manufacturers would prefer you were compelled to buy their latest vehicle instead.

I thought I saw an HDMI connector, but maybe I was wrong.

How many PoE adapters would it take to charge a Tesla?

It could probably run it and learn to play it too.

I was more fascinated that a new wiring harness was $80! I've easily spent $30-50 for a single VAG cable 1ft pigtail.

> how could someone be this deep into a project of this depth and not realize this

I think this is a software guy who occasionally dips into hardware things (to hunt bugs).

Even if you know that cars consist of a single wiring harness, it's not implied that they aren't modular and the individual cables cannot be purchased separately.

> and to Tesla's credit they have amazing free docs

Not to Tesla's credit, they had to be dragged kicking and screaming into it (primarily by Massachusetts) and their right to repair legislation through a solid chunk of malicious compliance:

1. When told that they had to have a site for people to order parts, Tesla put up a site that had every single item as "Call us", including the most simple of bolts. And when a few places called, "Sorry, that's not available to you".

2. The service manual was originally only available in a few locations in MA, and had strict conditions: you had to book in advance, there was a $100 fee per booking, and you could only view the manual on premises, and could not bring electronic devices into the room with you, just pen and paper.

The docs they have are great, and who knows how their attitude would have changed over time, but they absolutely didn't want you to have it, initially.

I will say I’m surprised how far apart the two boxes are in the car. I guess they’re not where I thought. I would assume they’re both up near the dash.

> I was really surprised to read this at the end of the article -- how could someone be this deep into a project of this depth and not realize this?!

Usually, for most other vehicles, the connectors are either standardized (e.g. radios, ISO 10487 [1], high-current chargers by VG 96917) or the foundation plugs, sockets and re-pinning tools are readily available by the vehicle manufacturer or by aftermarket suppliers.

Tesla truly went out of their way to make the life of third parties (such as wire harness repair shops) more miserable here.

[1] https://de.wikipedia.org/wiki/ISO_10487

EVS have actually managed to reduce the number of wire bundles (mostly due to switching to Ethernet instead of CAN Bus)

Software people tend to overestimate their knowledge of other disciplines, writing it off as "easy" or work beneath them. Being overpaid compared to your peers certainly doesn't help dispel this feeling. Some people have built entire careers around designing wire looms.

I'm sure you're an expert, pro at everything.

It actually stands for "lizard brain"... it is (or at least was) an Infineon Aurix control and monitoring microcontroller, they may have changed to a newer one.

As a result of this and the child comments…

As an Australian. I often find myself saying things like “the wiring hardness, or loom, or cable, or whatever were calling it this week”.

Exasperated by living in a state other than the one I grew up in. South Australians are often easily spotted by their pronunciation of certain words.

And, of course, Germans have a dedicated composite noun for it: Kabelbaum (literal translation: cable tree).

So what do you call the tubing around the wire bundle? That’s what we call “loom”.

Human have a better taste (at least for now :D)

Interesting take–– I feel the total opposite; I love the UI.

It's glass...