Tesla Powerwalls Exposed To Password Hacks Via Google

[DougSpindler]

Opps.  Tesla Powerwalls Exposed To Password Hacks Via Google

Anyone following this story?  I can just see the script kiddies having fun with this one.

[I wanted a rude username]

Only found one article about it: https://www.forbes.com/sites/thomasbrewster/2020/11/17/hundreds-of-tesla-powerwalls-exposed-to-potential-password-hacks-via-google---dont-let-one-be-yours/

Presumably this is only notable because Tesla is hot right now. This kind of thing happens all the time. It's the whole reason why Shodan exists: https://www.shodan.io/

[DougSpindler]

The point is this should NOT be happening all of the time.  Don’t you agree it shouldn’t be?

[I wanted a rude username]

As a former IT consultant ("What's this device uploading gigabytes per day to a Chinese cloud server? Oh it's that Dahua CCTV system your lowest bidder installed last year."), I could dictate a doctoral thesis on how wrong all of this is. But it wouldn't change the facts:

• Customers are stupid and lazy
• Companies are rushed and greedy

There is no mechanism for it to not happen all the time. All you can do is protect your own infrastructure.

[DougSpindler]

You are forgetting how programmers don’t make their code secure.  Any idea how many apps have security holes in them from crappy programming?

[I wanted a rude username]

You are forgetting

Nope, already covered that in point 2. Companies won't give their engineers the time ... because we won't pay double for premium products. It's a race to the bottom ... and it's our fault.

[maginnovision]

Tesla is the expensive option so I guess no matter how much you pay you're going to get yourself a plate of vomit.

[Phoenix]

I saw a similar article about powerwalls with default password and always on wifi.
https://github.com/hackerschoice/thc-tesla-powerwall2-hack

Security of these distributed energy and storage resources is becoming very important. Already, in certain places/certain times you could take down a grid if you could get a decent portion of them to push/pull power simultaneously - or even worse flip them all back and forward at full power constantly.

[DougSpindler]

We have already in the US seen the grid be taken down by hackers and a computer virus.

I wonder if it is companies not giving programmers not enough time to write secure code or if is more of a case programmers do not know how to write secure code.  From what I have seen it’s more the latter.   

[f4eru]

It's often a case of culture in the IT world.
Security ? we are secure because we said so, nothing to see here, move on.

[sandalcandal]

Tesla is the expensive option....

Hang on, last I checked Tesla Powerwall is a cheapest per kWh and life time system cost. Where are you getting that it's the expensive option?

Also in case people are too lazy to read the Forbes article I wanted a rude username linked:

Beardsley discovered there was one possible path into the gateway, thanks to weak default logins: a user name of any email address and a password of the last five characters of the gateway serial number.

I'm surprised they don't use a pseudo-random string like most consumer Wi-Fi routers these days.

First-party disclosure of the "hack" from the security company cited in the Forbes article that disclosed it. https://blog.rapid7.com/2020/11/17/dont-put-it-on-the-internet-tesla-backup-gateway-edition/ [Also seems to be miss attributed in the Forbes article to Tod Beardsley instead of Derek Abdine?] Edit: Sent Forbes author an email to check. Edit 2: No reply but attribution has been semi-corrected in the Forbes article.
It's less clear in the Forbes article but they didn't actually hack into any Powerwalls and control them. They did however point out and demonstrate there's plenty of info that can be scraped without authentication if the AP can be discovered and 379 were discovered via a Google database hack. They also point out the potential vulnerability to hack into and tamper with the system due to weak default credentials and link to another even earlier security disclosure here https://github.com/hackerschoice/thc-tesla-powerwall2-hack/blob/master/README.md[Just noticed its the same post Phoenix linked.]
But the Rapid7 post also points out the issue has been fixed for some time.

Prior to publication, we reached out to Tesla's Product Security about this, and they let us know that they are working on further mitigating accidental exposure in some upcoming security features. In the meantime, they let us know that "predictable installer passwords have been fixed for some time on newly commissioned Backup Gateway V1 devices, but some previously commissioned devices still had them, and all online Backup Gateway V1 devices have had their installer passwords randomized." In addition, "all Backup Gateway V2 devices come from the factory with non-predictable random passwords," so that all sounds like good news going forward.

Edit: The Forbes article also mentions this right at the end.
Quick search seems to confirm that: https://www.tesla.com/sites/default/files/images/support/powerwall/support-powerwall-backup-gateway-002.png

Also pointed out in the Rapid7 article, the powerpack units which are used for battery farms are also on the internet! Though no published hacking of those yet from Rapid7.

2FA has also been implemented but no signs they force users to setup and use it. https://www.tesla.com/en_AU/support/multi-factor-authentication?redirect=no

Opps.  Tesla Powerwalls Exposed To Password Hacks Via Google

Anyone following this story?  I can just see the script kiddies having fun with this one.

Looks like the recent 2nd-hand news articles are reporting on some fairly outdated security disclosures and no longer present vulnerabilities 
Predictably no one reads the ****ing article and just start slinging based of the title alone  (Even worse not linking any article in the OP)

[SilverSolder]

[...]
Predictably no one reads the ****ing article and just start slinging based of the title alone  (Even worse not linking any article in the OP)

Welcome to how news is distributed and digested in the Year of our Lord 2020!   

[jh15]

Where/when was that?

[jh15]

Where/when was that? The power grid taken down?

[wraper]

Tesla is the expensive option....

Hang on, last I checked Tesla Powerwall is a cheapest per kWh and life time system cost. Where are you getting that it's the expensive option?

He is Tesla/Elon hater, never seen him providing any actual info when making negative comments about them, only accusations.

[madires]

Anyone surprised? There are always some internet experts who connect workgroup laser printers or control systems of water treatment plants directly to the internet, commonly with default passwords or sometimes with no password at all. What could possibly go wrong?

[sandalcandal]

Anyone surprised? There are always some internet experts who connect workgroup laser printers or control systems of water treatment plants directly to the internet, commonly with default passwords or sometimes with no password at all. What could possibly go wrong?

Well at least Tesla seem to have randomised passwords by default now so you'd have to at least get physical access to read the password off the label to get access; even if the installer/user does nothing.

[madires]

It's like placing a spare key under the door mat or flower pot.

[sandalcandal]

It's like placing a spare key under the door mat or flower pot.

As opposed to leaving the key in the lock? 
It's a default that's meant to be changed but at least some remote malicious body can't get free access by guessing common phrases or brute forcing which can definitely occur otherwise due to user complacency.
Edit: Actually might be safer not changing it, otherwise you'd have to use another random password generator and keep that password safe elsewhere for it to be any more secure. Then there's also 2FA which is also available but not mandated.

[wraper]

It's like placing a spare key under the door mat or flower pot.

As opposed to leaving the key in the lock? 
It's a default that's meant to be changed but at least some remote malicious body can't get free access by guessing common phrases or brute forcing which can definitely occur otherwise due to user complacency.

More like building thousands of houses with the same lock, and displaying the key on a town square. Old Soviet satire short film displaying exactly that (it actually happened).

[f4eru]

There are always some internet experts who connect workgroup laser printers or control systems of water treatment plants directly to the internet, commonly with default passwords or sometimes with no password at all.

That is a design fail of the equipment right there.
- Either a product should not have a default password common to his siblings (use a random one printed out in the manual or so)
- Or it should be blocked to not function until it is configured with a password.

[Ed.Kloonk]

We have already in the US seen the grid be taken down by hackers and a computer virus.

I wonder if it is companies not giving programmers not enough time to write secure code or if is more of a case programmers do not know how to write secure code.  From what I have seen it’s more the latter.

It doesn't help that whilst there are supposed to be laws to bring to justice anyone doing something malicious, rarely is anyone ever dealt with. What happens is that the hole someone discovered gets patched.

However, if you the consumer were to preform your own penetration testing on a company's infrastructure which holds your own private information, the law doesn't look on you too favorably if you are discovered to be poking around.

Understand that software code is usually built with functionality being the goal at first. Security hardening is added once your widget is working, tacked on as an after-thought.

[maginnovision]

Tesla is the expensive option....

Hang on, last I checked Tesla Powerwall is a cheapest per kWh and life time system cost. Where are you getting that it's the expensive option?

He is Tesla/Elon hater, never seen him providing any actual info when making negative comments about them, only accusations.

That's not true at all. I can build a better battery for 1/4 the cost using new cells. I can buy them for about 1/2. After that you just add the inverter you need/want. Powerwall is about 11.5k for 13.5kWh. That's not great and you can't keep them outdoors if it's cold or hot where you live(their recommendation). You can make your own judgement call based on where you live and your power usage.

https://electrek.co/2020/10/01/tesla-tsla-increases-powerwall-price-demand/

EDIT: The quote I got was 13K for one and 25K for two(with tax).

[wraper]

That's not true at all. I can build a better battery

That's some rather bold claim. Good luck with that. Especially with precisely balancing them at which Tesla is best on the market.

for 1/4 the cost using new cells.

Even if this is true, they will not be the same spec batteries. Also Powerwall certainly does not use their full capacity to increase their lifespan.

After that you just add the inverter you need/want.

Powerwall includes that, so price comparison is apples vs oranges. And your quote comes with installation and any supporting hardware needed. If you want to compare the price, compare it with other off the shelf solution, not diy project (which rarely go as expected).

[DougSpindler]

Where/when was that? The power grid taken down?

As I recall it started around Ohio and spread from there.