Tesla Powerwalls Exposed To Password Hacks Via Google - Page 1
Forum section: electronics / general

author: DougSpindler
author_rank: Super Contributor
timestamp: November 18, 2020, 02:16:43 am
content: Opps. Tesla Powerwalls Exposed To Password Hacks Via GoogleAnyone following this story? I can just see the script kiddies having fun with this one.

author: I wanted a rude username
author_rank: Frequent Contributor
timestamp: November 18, 2020, 02:39:06 am
content: Only found one article about it:https://www.forbes.com/sites/thomasbrewster/2020/11/17/hundreds-of-tesla-powerwalls-exposed-to-potential-password-hacks-via-google---dont-let-one-be-yours/Presumably this is only notable because Tesla is hot right now. This kind of thing happens all the time. It's the whole reason why Shodan exists:https://www.shodan.io/

author: DougSpindler
author_rank: Super Contributor
timestamp: November 18, 2020, 03:17:51 am
content: The point is this should NOT be happening all of the time. Don’t you agree it shouldn’t be?

author: I wanted a rude username
author_rank: Frequent Contributor
timestamp: November 18, 2020, 04:31:55 am
content: As a former IT consultant ("What's this device uploading gigabytes per day to a Chinese cloud server? Oh it's that Dahua CCTV system your lowest bidder installed last year."), I could dictate a doctoral thesis on how wrong all of this is. But it wouldn't change the facts:Customers are stupid and lazyCompanies are rushed and greedyThere is no mechanism for it to not happen all the time. All you can do is protect your own infrastructure.

author: DougSpindler
author_rank: Super Contributor
timestamp: November 18, 2020, 08:17:33 pm
content: You are forgetting how programmers don’t make their code secure. Any idea how many apps have security holes in them from crappy programming?

author: I wanted a rude username
author_rank: Frequent Contributor
timestamp: November 18, 2020, 10:14:35 pm
content: Quote from: DougSpindler on November 18, 2020, 08:17:33 pmNope, already covered that in point 2. Companies won't give their engineers the time ... becausewewon't pay double for premium products. It's a race to the bottom ... and it's our fault.

author: maginnovision
author_rank: Super Contributor
timestamp: November 18, 2020, 10:34:44 pm
content: Tesla is the expensive option so I guess no matter how much you pay you're going to get yourself a plate of vomit.

author: Phoenix
author_rank: Frequent Contributor
timestamp: November 19, 2020, 02:56:40 am
content: I saw a similar article about powerwalls with default password and always on wifi.https://github.com/hackerschoice/thc-tesla-powerwall2-hackSecurity of these distributed energy and storage resources is becoming very important. Already, in certain places/certain times you could take down a grid if you could get a decent portion of them to push/pull power simultaneously - or even worse flip them all back and forward at full power constantly.

author: DougSpindler
author_rank: Super Contributor
timestamp: November 19, 2020, 03:18:05 am
content: We have already in the US seen the grid be taken down by hackers and a computer virus.I wonder if it is companies not giving programmers not enough time to write secure code or if is more of a case programmers do not know how to write secure code. From what I have seen it’s more the latter.

author: f4eru
author_rank: Super Contributor
timestamp: November 19, 2020, 08:48:10 am
content: It's often a case of culture in the IT world.Security ? we are secure because we said so, nothing to see here, move on.

author: sandalcandal
author_rank: Unknown
timestamp: November 19, 2020, 10:46:20 am
content: Quote from: maginnovision on November 18, 2020, 10:34:44 pmHang on,last I checkedTesla Powerwall is a cheapest per kWh and life time system cost. Where are you getting that it's the expensive option?Also in case people are too lazy to read the Forbes articleI wanted a rude usernamelinked:Quote from: Thomas Brewster @ ForbesI'm surprised they don't use a pseudo-random string like most consumer Wi-Fi routers these days.First-party disclosure of the "hack" from the security company cited in the Forbes article that disclosed it.https://blog.rapid7.com/2020/11/17/dont-put-it-on-the-internet-tesla-backup-gateway-edition/[Also seems to be miss attributed in the Forbes article to Tod Beardsley instead of Derek Abdine?] Edit: Sent Forbes author an email to check. Edit 2: No reply but attribution has been semi-corrected in the Forbes article.It's less clear in the Forbes article but they didn't actually hack into any Powerwalls and control them. They did however point out and demonstrate there's plenty of info that can be scraped without authentication if the AP can be discovered and 379 were discovered via a Google database hack. They also point out thepotential vulnerabilityto hack into and tamper with the system due to weak default credentials and link to another even earlier security disclosure herehttps://github.com/hackerschoice/thc-tesla-powerwall2-hack/blob/master/README.md[Just noticed its the same post Phoenix linked.]But the Rapid7 post also points outthe issue has been fixed for some time.Quote from: Derek Abdine @ Rapid7Edit: The Forbes article also mentions this right at the end.Quick search seems to confirm that:https://www.tesla.com/sites/default/files/images/support/powerwall/support-powerwall-backup-gateway-002.pngAlso pointed out in the Rapid7 article, the powerpack units which are used for battery farms are also on the internet! Though no published hacking of those yet from Rapid7.2FA has also been implemented but no signs they force users to setup and use it.https://www.tesla.com/en_AU/support/multi-factor-authentication?redirect=noQuote from: DougSpindler on November 18, 2020, 02:16:43 amLooks like the recent 2nd-hand news articles are reporting on some fairly outdated security disclosures and no longer present vulnerabilitiesPredictably no one reads the ****ing article and just start slinging based of the title alone(Even worse not linking any article in the OP)

author: SilverSolder
author_rank: Super Contributor
timestamp: November 19, 2020, 01:13:57 pm
content: Quote from: sandalcandal on November 19, 2020, 10:46:20 amWelcome to how news is distributed and digested in the Year of our Lord 2020!

author: jh15
author_rank: Frequent Contributor
timestamp: November 19, 2020, 01:35:24 pm
content: Where/when was that?

author: jh15
author_rank: Frequent Contributor
timestamp: November 19, 2020, 01:37:12 pm
content: Quote from: jh15 on November 19, 2020, 01:35:24 pm

author: wraper
author_rank: Unknown
timestamp: November 19, 2020, 01:54:16 pm
content: Quote from: sandalcandal on November 19, 2020, 10:46:20 amHe is Tesla/Elon hater, never seen him providing any actual info when making negative comments about them, only accusations.

author: madires
author_rank: Super Contributor
timestamp: November 19, 2020, 02:03:10 pm
content: Anyone surprised? There are always some internet experts who connect workgroup laser printers or control systems of water treatment plants directly to the internet, commonly with default passwords or sometimes with no password at all. What could possibly go wrong?

author: sandalcandal
author_rank: Unknown
timestamp: November 19, 2020, 02:09:09 pm
content: Quote from: madires on November 19, 2020, 02:03:10 pmWell at least Tesla seem to have randomised passwords by default now so you'd have to at least get physical access to read the password off the label to get access; even if the installer/user does nothing.

author: madires
author_rank: Super Contributor
timestamp: November 19, 2020, 02:24:14 pm
content: It's like placing a spare key under the door mat or flower pot.

author: sandalcandal
author_rank: Unknown
timestamp: November 19, 2020, 02:27:01 pm
content: Quote from: madires on November 19, 2020, 02:24:14 pmAs opposed to leaving the key in the lock?It's a default that's meant to be changed but at least some remote malicious body can't get free access by guessing common phrases or brute forcing which can definitely occur otherwise due to user complacency.Edit: Actually might be safer not changing it, otherwise you'd have to use another random password generator and keep that password safe elsewhere for it to be any more secure. Then there's also 2FA which is also available but not mandated.

author: wraper
author_rank: Unknown
timestamp: November 19, 2020, 02:34:04 pm
content: Quote from: sandalcandal on November 19, 2020, 02:27:01 pmMore like building thousands of houses with the same lock, and displaying the key on a town square. Old Soviet satire short film displaying exactly that (it actually happened).

author: f4eru
author_rank: Super Contributor
timestamp: November 19, 2020, 04:46:40 pm
content: QuoteThat is a design fail of the equipment right there.- Either a product should not have a default password common to his siblings (use a random one printed out in the manual or so)- Or it should be blocked to not function until it is configured with a password.

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: November 19, 2020, 05:19:58 pm
content: Quote from: DougSpindler on November 19, 2020, 03:18:05 amIt doesn't help that whilst there are supposed to be laws to bring to justice anyone doing something malicious, rarely is anyone ever dealt with. What happens is that the hole someone discovered gets patched.However, if you the consumer were to preform your own penetration testing on a company's infrastructure which holds your own private information, the law doesn't look on you too favorably if you are discovered to be poking around.Understand that software code is usually built with functionality being the goal at first. Security hardening is added once your widget is working, tacked on as an after-thought.

author: maginnovision
author_rank: Super Contributor
timestamp: November 19, 2020, 05:35:30 pm
content: Quote from: wraper on November 19, 2020, 01:54:16 pmThat's not true at all. I can build a better battery for 1/4 the cost using new cells. I can buy them for about 1/2. After that you just add the inverter you need/want. Powerwall is about 11.5k for 13.5kWh. That's not great and you can't keep them outdoors if it's cold or hot where you live(their recommendation). You can make your own judgement call based on where you live and your power usage.https://electrek.co/2020/10/01/tesla-tsla-increases-powerwall-price-demand/EDIT: The quote I got was 13K for one and 25K for two(with tax).

author: wraper
author_rank: Unknown
timestamp: November 19, 2020, 08:10:01 pm
content: Quote from: maginnovision on November 19, 2020, 05:35:30 pmThat's some rather bold claim. Good luck with that. Especially with precisely balancing them at which Tesla is best on the market.QuoteEven if this is true, they will not be the same spec batteries. Also Powerwall certainly does not use their full capacity to increase their lifespan.QuotePowerwall includes that, so price comparison is apples vs oranges. And your quote comes with installation and any supporting hardware needed. If you want to compare the price, compare it with other off the shelf solution, not diy project (which rarely go as expected).

author: DougSpindler
author_rank: Super Contributor
timestamp: November 19, 2020, 08:17:11 pm
content: Quote from: jh15 on November 19, 2020, 01:37:12 pmAs I recall it started around Ohio and spread from there.

author: Cerebus
author_rank: Super Contributor
timestamp: November 19, 2020, 08:52:31 pm
content: People should NOT be posting vague, unsubstantiated claims about the US grid being taken down by hackers and a computer virus. Don’t you agree they shouldn’t be doing this?

author: Bud
author_rank: Super Contributor
timestamp: November 19, 2020, 09:21:47 pm
content: Tell this to your crooked mass media.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 19, 2020, 10:27:32 pm
content: Quote from: maginnovision on November 19, 2020, 05:35:30 pmSo one Powerwall has similar capacity to 5x 200Ah 12V lead acid batteries, costing < $400 each or < $2,000 total. Then you'd need an inverter etc.

author: maginnovision
author_rank: Super Contributor
timestamp: November 19, 2020, 10:32:04 pm
content: Yea, even with an inverter the cost is less. I've already built backup systems for people before. Even after paying me they paid less for more. I'm not going to argue... If you like powerwalls then buy them.

author: wraper
author_rank: Unknown
timestamp: November 19, 2020, 10:49:33 pm
content: Powerwall itself costs $7k for 13.5 kWh with 7kW peak and 5kW continuous power, contains charger and inverter, so you have a fair comparison. That price quote is for a fully installed system with all permits, inspections and whatnot. And is on the high side, so it may have something to do with your location or something like that. DIY battery will be illegal and of dubious safety. Don't forget it contains tremendous amount of energy and can burn down your house easily, if something goes wrong. And your insurance company will tell you to screw yourself.

author: sandalcandal
author_rank: Unknown
timestamp: November 19, 2020, 11:08:21 pm
content: Quote from: wraper on November 19, 2020, 10:49:33 pmDesign/installation safety plus various stamp duties aside, I'm interested in if it's a fundamentally better cost-utility choice based on technology rather than implemention.Quote from: SilverSolder on November 19, 2020, 10:27:32 pmQuote from: maginnovision on November 19, 2020, 10:32:04 pmSo your equivalent but cheaper system uses lead acid batteries (deep cycle AGM I presume?) with an equal 100% DoD capacity? If you intend to use it only a handful of times per year to stop the lights going out and just have them on float the rest of the time as a UPS then I guess that's fit for purpose but I can't see that being a better lifetime (or even upfront) cost if the batteries are actively being used daily to provide off-peak on-peak balancing and solar energy storage to actually help grid stability or cut down your electricity bill.Can I ask how your systems are holding up long term?

author: RenThraysk
author_rank: Regular Contributor
timestamp: November 20, 2020, 12:05:33 am
content: Try #2, lost first post attempt.Bit embarrassing.Hopefully serious companies will start using zero trust architectures.There is no reason why every device on the internet should be able to contact, let alone being able submit a login request to your powerwall.ZeroTier and Tailscale are two companies provided products that aim to solve this problem, without the burden and hassle of outdated methods.

author: maginnovision
author_rank: Super Contributor
timestamp: November 20, 2020, 06:45:37 pm
content: Quote from: sandalcandal on November 19, 2020, 11:08:21 pmNo, I don't use lead acid batteries. I use different batteries for different builds. Lithium ion and lithium polymer (polymer pouch cells are cheaper and better density but I only use them for temp controlled installs) along with lithium iron phosphate for people who want the best long term solutions(also becoming best overall anyway). They have all the expected safety features as well.As far as lifetime the oldest installs are only ~5 years old. No issues but I wouldn't say it's been long enough to say what the performance really is compared to powerwall 2's claims(don't forget the original "powerwall" was pretty poor and hard not to beat). Compared to initial specs, and 5 year performance they're outperforming powerwall 2 in initial cost, and kWh/$ and they're on track for that to continue barring any failures. What Tesla has is a fancy package(the work is contracted out) where I use cabinets which can be painted any color. At this point I haven't built or installed one in about a year but the only thing that has changed is prices have gone down.

author: sandalcandal
author_rank: Unknown
timestamp: November 21, 2020, 04:11:11 am
content: Sorry, this is getting a bit off-topic.Quote from: maginnovision on November 20, 2020, 06:45:37 pmSo you reduce costs by sourcing your own cells, building your own packs (and BMS systems?), using off-the-shelf cabinets and providing your own labour?Let me estimate the costs of that compared to a Tesla Powerwall at 7000/14=500 $US/kWh and tell me if I'm making any errors.For small qty. commercial or DIY initial cost for cells alone is at best 300 $US/kWh (most are closer to 400 $US/kWh) though I've seen some questionable looking Chinese import cells as low as ~200 $US/kWh. For assembled packs including BMS:a quality USA domestic assembled packcosts 740 $US/kWh but"known" quality Chinese are 400 $US/kWh. In a best case you've got 200 $US/kWh saving compared to the full cost of a powerwall but more likely you have only 100 $US/kWh and if you really want an "expensive" option you'll be losing 240 $/kWh already. Sowith 14 kWh of cells alone you have at best $US 2800 to come up with BMS, 5kW inverter and enclosure.If you're using pouch cells you need to have additional mechanical components for clamping the pouches properly.Edit2:Salvaged/Surplus/2nd hand cells are another option which can go down to ~100 $US/kWhbut are very subject to availability and have added risks with warranties, liabilities and some extent safety depending on the source.Cheapest "known" 5kW (pure sine) inverter on Amazon is $US 550(I've had issues testing an inverter from this brand in a prototype system),a "cheap" made in China inverter from a US company is $US1299anda quality 5kVA inverter is $US 2540So with the inverter included you're now $US 1500 left for the rest of the system or nearly completely out if you want to go with the high-end solution.Other components are relatively low cost: ~$US200 for the cabinet, ~$US150 BMS and then a bit extra for cables, fuses, connectors etc.Best case, you'd be saving $US 1000 on a $US 7000 component and you're putting together your own using low-tier, made-in-china parts, at cost, with your own labour free instead of buying a complete, ready-to-go, made in the US system with a 10yr warranty and commercial support.Its not even like you can't just buy the Powerwall as a component and install it yourself (at least in Australia)https://www.ecoelectric.com.au/shop/tesla-powerwall-tesla-14kwh-battery.htmlEdit: All of the listed inverters apart from the last $US 2540 Victron don't have chargers, grid-tie or standards certifications like the Powerwall.A made in Taiwan, UL listed, 6kW inverter charger from a US company costs $US 2011 but still doesn't have grid tie.That'd make it $US 500 saving best case but should really be more like losing $200 if actually comparing to the functionally equivalent Victron that does grid-tie and charging.Quote from: maginnovision on November 19, 2020, 10:32:04 pmI'dreallylike to know what you're doing to achieve that.

author: DougSpindler
author_rank: Super Contributor
timestamp: November 21, 2020, 05:59:05 am
content: I’m not an expert but your figures are reasonable. And if one just thinks about it with a DIY you are going to pay “retail prices” for the components when you build one or two, so the only savings would be in the labor to design, assemble and test. And you are correct, there is no warranty or guarantee the thing a DIY built won’t disappear in a puff a smoke or worse, spontaneously combust and create a nice fire as we have seen happen with cell phone and computer laptop batteries. Heck we’ve even seen Tesla cars in accidents be destroyed from electrical fires after an accident.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 21, 2020, 03:22:21 pm
content: If you are going to DIY, lead-acid makes sense: low cost, easily available.Of course there are risks with this, but there are also risks with having 1,000 gallon heating oil tanks in your basement... or an oxy-acetylene torch set in the garage... etc.

author: wraper
author_rank: Unknown
timestamp: November 21, 2020, 03:43:11 pm
content: Quote from: SilverSolder on November 21, 2020, 03:22:21 pmBut it's relatively inefficient and will not last long. Good luck with achieving 5000+ charge cycles, 90% round trip efficiency and 10+ years lifetime out of lead-acid battery.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 21, 2020, 03:50:16 pm
content: Quote from: wraper on November 21, 2020, 03:43:11 pmAbsolutely true. But there are some light-duty use cases where this works fine, for example for back-up power in case of outages.

author: sandalcandal
author_rank: Unknown
timestamp: November 21, 2020, 04:04:54 pm
content: Quote from: SilverSolder on November 21, 2020, 03:50:16 pmI also already said lead acid might be fine for a UPS, backup type systembut Powerwalls are for solar storage and on-peak off-peak levelling so its not really an equivalent comparison; particularly for lifetime cost.

author: DougSpindler
author_rank: Super Contributor
timestamp: November 21, 2020, 04:23:00 pm
content: Quote from: SilverSolder on November 21, 2020, 03:50:16 pmHow is back-up power in case of an outage considered light duty? With most outages lasting hours to days how it that light duty? Light duty would be powering a few LEDs.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 21, 2020, 07:37:55 pm
content: Quote from: DougSpindler on November 21, 2020, 04:23:00 pm"Light duty" is obviously subjective, but that's what I would call running a fridge and a couple of lamps, less than 500W, for max 12 hours.

author: madires
author_rank: Super Contributor
timestamp: November 22, 2020, 09:55:16 am
content: Quote from: SilverSolder on November 21, 2020, 03:22:21 pm... when you get them for nearly free. The standard types don't survive much cycles and the types optimized for PV with more cycles are expensive. Li-Ion provides a real alternative.

author: SilverSolder
author_rank: Super Contributor
timestamp: November 22, 2020, 01:19:01 pm
content: Quote from: madires on November 22, 2020, 09:55:16 amNobody is disputing that Li-Ion has better cycle life etc., but it is also significantly more expensive than Pb-Acid - so, if you don't need the cycle life... why buy more than you need?A 200Ah, 12V battery can be yours for less than $400, without searching very hard. Just one of those can run a fridge for 12 hours...People have been using this technology in recreational vehicles for decades - it is mature technology.

author: NiHaoMike
author_rank: Super Contributor
timestamp: November 22, 2020, 04:20:28 pm
content: Quote from: sandalcandal on November 21, 2020, 04:11:11 amGood quality batteries are available for less than $120/kWh.https://batteryhookup.com/For the inverter, hack a Prius inverter and you'll get something that can easily handle 10-20kW continuous and well over 50kW peak.The BMS is not that difficult to DIY, a string of microcontrollers with optoisolators to cascade the serial communication would probably be the easy option that doesn't require hard to find ASICs.

author: wraper
author_rank: Unknown
timestamp: November 22, 2020, 04:38:44 pm
content: Quote from: NiHaoMike on November 22, 2020, 04:20:28 pmI only see used batteries at such price.

author: sandalcandal
author_rank: Unknown
timestamp: November 23, 2020, 02:10:45 am
content: Quote from: wraper on November 22, 2020, 04:38:44 pmBatteryhookup.com is salvaged (and tested), used, surplus and NoS batteries. Popped into my mind last night as another option actually.Salvage/2nd-hand is a viable option for DIY and small business (for now) which you'll never be able to get from a tier 1 commercial manufacturer. Obviously there are downsides like liability, warranties and uncertain availability but I think there are people willing to accept those risks for a dirt cheap storage system. I'd hesitate to sell it as equivalent to a commercial off the shelf solution though.Availability is a big issue when trying to use salvage/surplus/2nd-hand (SSS?) cells. Every time a Leaf gets written off in Australia there's a pretty mad scramble to try grab the battery pack. Your only chance is having inside connections at the wreckers to get in before everyone else. Builds using salvage/surplus/2nd-hand cells are more opportunistic than something you can build a stable business around.