Hacker News Reader

Comment by aftbit | Hacker News Reader

Does a Tesla owner have root on their own vehicle, or is that privilege kept for the masters at the mothership?

Selling a car with intentional root access would almost certainly be illegal in the USA, and most places.

Cars have government-mandated safety features, and manufacturers are forbidden from adding kill switches. Selling a car with (manufacturer-sanctioned) root access would be legally the same as including a kill switch letting the owner disable safety features.

If an owner cuts their brake light wires to flee the cops, it's 100% on them. If a manufacturer included a switch for it, they'd be in massive trouble.

It can be argued that root access is not any kind of switch on its own. You have physical access either way - cutting a wire or reprogramming a EEPROM is already a kill switch, root access doesn't add to it, as long as manufacturer doesn't provide a script or otherwise encourages you to `kill -9 safetyprocess` or something.

Unless it's mandated by law that there must be anti-circumvention features (components checking system integrity, DRM-like), which root access would actually contradict. But that'd be completely different from prohibition to introduce a kill switch. That'd be a legal requirement that a vehicle or some of its parts mustn't be user-serviceable.

Root access is not a way to break stuff, even though it can be (ab)used as such - it's most certainly not its primary use case. It's a maintenance feature, enabling rightful owner to be able to diagnose, maintain and enhance their own vehicle's software without resorting to hacks. I'm sure that most people would use that to tweak their multimedia console (like adding CarPlay support) or get more diagnostic info about some failure they're facing, not hack their engine control module in some illegal way.

You can argue to NHTSA, sure. Good luck.

NHTSA forced Tesla to do a recall because the in-car computer allowed the owner to play custom audio on top of ("obscuring") the pedestrian warning tone.[0] If the in-car computer allowed them root access, NHTSA would have an aneurysm.

  > as long as manufacturer doesn't provide a script or otherwise encourages you to `kill -9 safetyprocess` or something.

Doesn't matter.

Scripts will be circulating online within days. If Tesla doesn't stop it, now they're knowingly complicit. Headlines will feature sympathetic low-knowledge users who followed directions, reasoning that it's safe because "why would Tesla let me do it otherwise??" Fin.

A rooted car is a nice dream, but it's just a dream. We'll never be allowed to sell a (fully) rooted car, just like we can't sell a fully-rooted (w baseband) phone. The Wild West is over folks! Last round's on me... :)

If we're very lucky, some manufacturer might give root access to a (heavily firewalled / air-gapped) media computer.

[0] https://static.nhtsa.gov/odi/rcl/2022/RCONL-22V235-2686.pdf

The issue in this particular case was ability to override pedestrian warning system. It is required to emit certain frequencies so (blind/or a pedestrian who is not visually attentive to their surroundings) can hear the vehicle coming (or going) Tesla made it a feature to allow users to mess with this requirement.

However it goes without saying if users could play a tone of their choice in addition to the required noise, no one could have objected to it.

The vehicle effectively became non compliant to one[1] of the fmvss rules

[1]https://www.regulations.gov/document/NHTSA-2016-0125-0001

Is there a list of "kill switches encoded in law autos can't make" somewhere?

I know the vehicle data recorder, and I've heard that LTE radios have to report occupancy, though I can't find a requirement that cars need an LTE radio.

There's rumors cars will be mandated to support remote deactivation, but the story is unclear: https://www.usatoday.com/story/news/factcheck/2023/01/19/fac...

relevant: https://consumerwatchdog.org/sites/default/files/2019-07/KIL...

Citation needed. By this logic no part of a car would be legally serviceable by the owner.

By this logic we shouldn't be allowed to drive them either, considering that enables a user to commit murder if not mass murder

...although I expect that to actually be a law once self driving is figured out and widespread

Driving is a necessary feature of a car, having a switch to turn off the brake light function isn't. You sure it's logic that you are applying?

"If an owner cuts their brake light wires to flee the cops"

Is this a tactic that people use to evade police? I can't really think of how this would be advantageous.

Aww, lucky! You're in for a great read.

https://www.wired.com/2007/10/ff-cannonballrun/

I'd read it, but eventually the ads took over the page and I was kicked outside of the paywall

Reader mode on Firefox on the initial page load removed the paywall block for me.

If your safety features could be disabled by root on a non-safety critical subsystem, it means your car is already unsafe by design.

'you vill ovn nothing' went from being a conspiracy theory to reality remarkably quickly.

The privilege is kept to the masters at the mothership. As a security researcher you can register your car and get an SSH certificate (bound to your VIN) to access your car as root.

On top of that, root won't give you _a lot of access_ to the car AFAIK. Some specific features are gated under some specific operations that require a sequence to unlock the gateway. If you also add to the mix the secure boot, it might be hard to do persistent harm other than what the infotainment usually does - you can't flash the autopilot system nor you can interfere with the basic driving functions (?). I'd be happy to be proven wrong though.

>Does a Tesla owner have root on their own vehicle

If they would, they wouldn't have to pay Tesla for the SW extras, and just sideload them for free later.

Reply on news.ycombinator.com