hachyderm.io is one of the many independent Mastodon servers you can use to participate in the fediverse.
Hachyderm is a safe space, LGBTQIA+ and BLM, primarily comprised of tech industry professionals world wide. Note that many non-user account types have restrictions - please see our About page.

Administered by:

Server stats:

9.2K
active users

Cassandrich

Has anyone done a full teardown of a Tesla's software stack? With full details on what/when/how it exfiltrates, what direct backdoors it has (short of updates), etc.?

I suspect not, and donating one to a hacker group willing to do this would be a great way to dispose of it.

@dalias

Do the same hacking for the Starlink network as well

@yuhasz01 Pwn starlink and deorbit the whole constellation.

@dalias @yuhasz01 Can you do that without triggering a Kessler cascade?

@tinydoctor @dalias

Starlink satellites only have 5 year life or so and many fall every day. System shut down could be staggered....

@tinydoctor @dalias @yuhasz01

You could take out all of Starlink with a suborbital sand bomb, but it would leave LEO unusable for a while.

@Phosphenes @dalias @yuhasz01 How much damage would low earth orbit not-Starlink stuff take?

@Phosphenes @tinydoctor @dalias @yuhasz01 I've been floating the idea of a strategic arsenal of these as an alternative to a nuclear arsenal. I suspect it could serve a similar purpose when dealing with space age states.

@dalias @yuhasz01 I’d stay up late to watch that

@dalias there was a thread years ago where someone who did provisioning etc. told a bunch of they did to/with the cars. It had me tearing my hairs out as a junior 🙃 I have not been able to dig it back up sadly.

@dcoderlt @dalias yes! That has to be it. The VPN / Jenkins stuff I remember 🥲

@dalias

jQuery.

jQuery and Electron all the way down.

/s

@dalias there's the SA leak/rant which someone else mentioned, and there was someone many years before that who got access to somewhere inside the infotainment cluster, published some info, and then got banned from all "online services" functionality

tbh we're pretty jaded by this idea though -- it requires such a specialized combination of technical skill, RE skill, and communications skill, and we just don't see much coming from it

@dalias for example, there was definitely talk (lost amongst the rest of the drama) of using the "nintendo switch" nvidia tegra bootrom exploit against much older cars, but nothing ever came of that

@r That was all assuming the person hacking on it cared about preserving the vehicle's value and "online service functionality".

Now the point is tanking the stock. Digging up dirt that can be used as a public narrative that they're unsafe and that Elon potentially intends to use them as an arm of technofascist control.

@dalias in that case, the bottleneck is probably "communications skills"?

e.g. defcon car hacking village has been around for a while, but the last time we visited it (a long time ago, 2019?) it was pretty understaffed on the "deeply technical outreach" front

otoh, academia types that have done experiments (including e.g. glitching the starlink user terminal) seem to struggle with marketing, timing "press" relations, and otherwise generally building larger grey-(or white)-hat movements

@r In some sense I think "car hacking" is the wrong interest space here.

@dalias it really depends on how exactly you read into the word "hacking", but yes we think we know what you're talking about. we've personally noticed a tension for years and have consequently always stayed only on the periphery of the "core professional infosec scene". we're only actively trying to get "more involved" now

@dalias er, in this case we were thinking of the tension between "infosec for wider ideological political goals" vs "infosec for defending existing systems (and thus by extension the status quo)"

there also exists the entire "car (sub)culture" hacking scene which is entirely disconnected from professional infosec, (in america) often associated with non-white groups, and with which information sharing has also never succeeded