3 ms·

I posted about this in another thread about this Tesla "hack", but they required physical access to the INSIDE of the vehicle. An access port in the driver-sid

I posted about this in another thread about this Tesla "hack", but they required physical access to the INSIDE of the vehicle. An access port in the driver-side footwell. How is this a security problem? If someone malicious has physical access to a normal car they could cut the brake lines or drain the oil, without even needing to unlock the car. If I'm inside a car I own I think I'd PREFER it to know I can hack into the car's systems rather than it being totally locked down.

jlg23 11y ago
From the wired article: But they also found that the car’s infotainment system was using an out-of-date browser, which contained a four-year-old Apple WebKit vulnerability that could potentially let an attacker conduct a fully remote hack to start the car or cut the motor. Theoretically, an attacker could make a malicious web page, and if someone in a Tesla car visited the site, could gain access to the infotainment system. “From that point, you’d be able to use a privilege escalation vulnerability to gain additional access and do the other stuff that we described,” Rogers says.
- cmiller1 11y ago
  > Theoretically Well, when they show, in practice, that such an attack is possible, then we can have news headlines about it. By presenting it like this so Tesla had to patch it to save face, I'm sure they just closed the loophole that would allow consenting car owners to modify their car's software. As a gear-head and life-long tinkerer, I WANT to be able to mess with my car.
boeing_boing 11y ago
Needing physical access isn't a limitation here given the browser exploit, but even if it was it is still a security problem. Cutting the brake lines and draining oil are very obvious methods of sabotage. Two minutes of investigation will make it clear that someone with malicious intent caused an accident. Malicious code uploaded to a car is hard to detect. The inconveniences, property damage, injuries, deaths and the ability to frame the individual as the cause of those intended consequences are incredibly valuable.

jlg23 11y ago

From the wired article: But they also found that the car’s infotainment system was using an out-of-date browser, which contained a four-year-old Apple WebKit vulnerability that could potentially let an attacker conduct a fully remote hack to start the car or cut the motor. Theoretically, an attacker could make a malicious web page, and if someone in a Tesla car visited the site, could gain access to the infotainment system. “From that point, you’d be able to use a privilege escalation vulnerability to gain additional access and do the other stuff that we described,” Rogers says.

cmiller1 11y ago
> Theoretically Well, when they show, in practice, that such an attack is possible, then we can have news headlines about it. By presenting it like this so Tesla had to patch it to save face, I'm sure they just closed the loophole that would allow consenting car owners to modify their car's software. As a gear-head and life-long tinkerer, I WANT to be able to mess with my car.

boeing_boing 11y ago

Needing physical access isn't a limitation here given the browser exploit, but even if it was it is still a security problem. Cutting the brake lines and draining oil are very obvious methods of sabotage. Two minutes of investigation will make it clear that someone with malicious intent caused an accident. Malicious code uploaded to a car is hard to detect. The inconveniences, property damage, injuries, deaths and the ability to frame the individual as the cause of those intended consequences are incredibly valuable.