Post #3964685
2026-07-20 16:26 UTC
Replies (6)
-
@vogelchr@chaos.social 2026-07-20 16:34
@syphist@zoner.work @faheus@chaos.social what I find particularly funny when reading the report: username/password is root/root. Also there’s no rate limit… 🤡 - well, seriously, this should be the first thing to try when being bored. Also, I feel slightly tempted to bodge a second power line modem into my cars charge port - for when I’m bored while topping up the battery… or maybe my car uses the Ethernet interface of these popular chipsets? Then maybe splice in an Ethernet switch?
-
@jbqueru@floss.social 2026-07-20 21:47
@syphist@zoner.work Most people creating such systems are having a hard enough time getting something that works at all for the intended use case that they don't have the mental capacity to investigate what happens when their system doesn't work. For better or worse, the world of software is a deades ahead, but putting software into everything doesn't make everyone an experienced software engineer. @vogelchr@chaos.social
-
@kkarhan@mastodon.social 2026-07-20 19:23
@syphist@zoner.work @vogelchr@chaos.social @faheus@chaos.social because #TechIlliterates run said industry???
-
@varx@defcon.social 2026-07-20 18:09
@syphist@zoner.work @vogelchr@chaos.social @faheus@chaos.social I don't work in automotive but I can tell you how it happened because its the same pattern in any OT industry.(Anyone in the automotive industry feel free to correct where I am wrong) A standards org designed the protocol, and chose TCP/IP over power line on purpose because it is free of licensing concerns, ubiquitous and real world tested. In the standard somewhere is probably some small note about limiting the services on this interface to only what the standard defines and not adding things like SSH (or they might mention that anything outside the standard is out of scope) An overworked engineer at a supplier of a supplier (so 2-3 subcontractor agreements away from any company you've ever heard of before) is tasked with making sure their board can talk this protocol properly. Their payment is tied to milestones on compatibility and reliability. So the engineer opens up an sshd over all interfaces to make debugging and dev easier for dev. They got a deadline to reach! They may or may not have something in the fine print telling the company that will integrate this to disable SSH or change a password or something. The integrator will not read that. When the integrator does their threat model or pen test they will pick the cheapest supplier and tightly control the scope of hardware and software under test. (Security is a cost center. Just need to show they did due diligence. ) They'll fix whatever small things the own handcuffed testers were able to find and call it good. Then it gets rolled out across the country slowly. Customers complain when things break or are not compatible, so new updates gets pushed out. Maybe a service tech even finds the SSH service and it saves them some time and money debugging in the field. "Wow that was convenient" they think. That's how this goes for years. Once enough are rolled out some curious hacker gets a little TOO curious and takes a serious look at the things in the field. They find the obvious integration holes, and submit a con talk out of it (after hopefully doing CVD where the manufacture will either do the smart thing and say 'mea culpa' then fix it before the talk .... Or do the dumb thing and try to sweep it under the rug) EV charging is already at the end of that process. Look at any new industrial technology and you'll see this play out. For example a simple google found me a new comms standard being made for Hydrogen cars last year. Its in that first part of the process. Give it a decade or two and $100 says there's similar gaps in the security of deployed pumps. https://www.sae.org/standards/j2799_202406-hydrogen-surface-vehicle-station-communications-hardware-software
-
@Colinvparker@mathstodon.xyz 2026-07-21 13:31
@syphist@zoner.work @vogelchr@chaos.social @faheus@chaos.social I think it makes the most sense if you imagine they started with a non-IP based communication. Imagine you had UART or something simple coupled onto the power line. Then this whole exploit goes away. Your security focuses on possible malicious traffic over the power line, which isn’t a problem as far as we can tell. root/root is fine in that case because the only thing that can send packets to sshd is hardware you control. Leave it open so a technician can log in easily with an Ethernet jack. But when you switch to a power line format that tunnels through IP, and all of a sudden Linux will treat incoming packets on the plug interface the same as incoming packets on any other interface, and route them to sshd, which likely never was intended or foreseen.
-
@monnier@oldbytes.space 2026-07-22 19:49
@syphist@zoner.work @vogelchr@chaos.social @faheus@chaos.social I'd guess they started with some SBC development board that came with an "SDK" that consist of a patched Linux kernel with some Armbianish tooling on top where the SDK provider set the "root:root" and the charger manufacturer never even considered the possibility of changing it (let alone looking to see if there's an SSH daemon running in the base config). The upside (down) is that once you offer "root:root" you don't need to worry about upgrading the kernel every time a new CVE comes along. 🙃