6 ms·

I hate when people use some brands publicity to promote themselves. Tesla clearly has no fault here. so basically: - you need to download an malicious app -

I hate when people use some brands publicity to promote themselves. Tesla clearly has no fault here. so basically: - you need to download an malicious app - your phone has to have some security bug to bypass 'sandbox' via some root privilidges I can understand if you blame google for android, or user for downloading app. But after this chain, there is virtually no app you cannot hack. >Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers. btw none of these suggestions preventing anything if you have the conditions above, suggests me they have no idea what they are talking about

obastani 10y ago
Do other car companies allow cars to be controlled via an Android app? Some people might see that as a feature, but to me that seems like a pretty bad product decision precisely because Android is so vulnerable.
- bluesign 10y ago
  if you mean by control, unlock, tracking etc, I am sure BMW supports.
- izacus 10y ago
  Yes, most major companies support mobile start with both ios and android apps.
janvidar 10y ago
There are lots of ways to get access to this data, installing an app is a pretty convenient and common way to do so. Any app can be hacked with enough effort. The Tesla app provided absolutely no resistance, and technically no privilege escalation is required to steal the relevant data. Your screen reader app, or custom keyboard has the relevant access. >Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers. We did not recommend this, however the OAuth token should not be in clear text.
- bluesign 10y ago
  you know that storing OAuth token in anyway (encrypted etc) doesnt change anything right? for screen readers and custom keyboards, thats why OS warns you with a really scary notice, that keyboard can read your passwords. I dont think you can read OAuth token without priviledge escalation btw.
- throwaway7767 10y ago
  > however the OAuth token should not be in clear text. How would you suggest to store it in a way that prevents someone with root access to the phone from reading it? Any encryption keys stored by the application would surely be just as easily readable by root, right?
- hibbelig 10y ago
  This blog post does contain those recommendations: https://promon.co/blog/tesla-cars-can-be-stolen-by-hacking-the-app/ https://promon.co/blog/tesla-cars-can-be-stolen-by-hacking-t... Near the bottom, it says: The app should provide its own keyboard for entering the username and password. Otherwise, malicious third party keyboards can act as keyloggers to obtain the user’s credentials. And: The app should be protected against reverse engineering.
  - problems 10y ago
    > The app should provide its own keyboard for entering the username and password. Otherwise, malicious third party keyboards can act as keyloggers to obtain the user’s credentials. This doesn't really help, if the attacker already has root on the device they can simply hook the login or key entry function in the application. They can also just screenshot on tap when the app is launched (though that's the lame way). > The app should be protected against reverse engineering. There's no such thing, I hate when people say things like this. If you rely on protections against reverse engineering, you rely on half-measures. A determined reverser will always break your app. It might take minutes or days, but it'll always happen and they only need to break it once for it to be broken for everyone. Ultimately this is a phone security issue. Don't download and run untrustworthy code, doubly so if your ROM is out of date and vulnerable. As the immutable law of security says: If someone has root on your device, it's not your device anymore!
zerker2000 10y ago
"Almost" doesn't count for security. Android is a known insecure platform, don't allow things running on the platform to open people's cars.
- gkafkg8y8 10y ago
  > Android is a known insecure platform And so is iOS, macOS, Windows, Linux, etc. if by insecure you mean "has has historically had security holes and can be used in an insecure manner". If you mean that Android is just "insecure" as a general statement, though, I'd have to disagree. The operating system itself can be used in a moderately secure way is relation to other popular mobile OS's like iOS.

obastani 10y ago

Do other car companies allow cars to be controlled via an Android app? Some people might see that as a feature, but to me that seems like a pretty bad product decision precisely because Android is so vulnerable.

bluesign 10y ago
if you mean by control, unlock, tracking etc, I am sure BMW supports.
izacus 10y ago
Yes, most major companies support mobile start with both ios and android apps.

janvidar 10y ago

There are lots of ways to get access to this data, installing an app is a pretty convenient and common way to do so. Any app can be hacked with enough effort. The Tesla app provided absolutely no resistance, and technically no privilege escalation is required to steal the relevant data. Your screen reader app, or custom keyboard has the relevant access. >Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers. We did not recommend this, however the OAuth token should not be in clear text.

bluesign 10y ago
you know that storing OAuth token in anyway (encrypted etc) doesnt change anything right? for screen readers and custom keyboards, thats why OS warns you with a really scary notice, that keyboard can read your passwords. I dont think you can read OAuth token without priviledge escalation btw.
throwaway7767 10y ago
> however the OAuth token should not be in clear text. How would you suggest to store it in a way that prevents someone with root access to the phone from reading it? Any encryption keys stored by the application would surely be just as easily readable by root, right?
hibbelig 10y ago
This blog post does contain those recommendations: https://promon.co/blog/tesla-cars-can-be-stolen-by-hacking-the-app/ https://promon.co/blog/tesla-cars-can-be-stolen-by-hacking-t... Near the bottom, it says: The app should provide its own keyboard for entering the username and password. Otherwise, malicious third party keyboards can act as keyloggers to obtain the user’s credentials. And: The app should be protected against reverse engineering.
- problems 10y ago
  > The app should provide its own keyboard for entering the username and password. Otherwise, malicious third party keyboards can act as keyloggers to obtain the user’s credentials. This doesn't really help, if the attacker already has root on the device they can simply hook the login or key entry function in the application. They can also just screenshot on tap when the app is launched (though that's the lame way). > The app should be protected against reverse engineering. There's no such thing, I hate when people say things like this. If you rely on protections against reverse engineering, you rely on half-measures. A determined reverser will always break your app. It might take minutes or days, but it'll always happen and they only need to break it once for it to be broken for everyone. Ultimately this is a phone security issue. Don't download and run untrustworthy code, doubly so if your ROM is out of date and vulnerable. As the immutable law of security says: If someone has root on your device, it's not your device anymore!

zerker2000 10y ago

"Almost" doesn't count for security. Android is a known insecure platform, don't allow things running on the platform to open people's cars.

gkafkg8y8 10y ago
> Android is a known insecure platform And so is iOS, macOS, Windows, Linux, etc. if by insecure you mean "has has historically had security holes and can be used in an insecure manner". If you mean that Android is just "insecure" as a general statement, though, I'd have to disagree. The operating system itself can be used in a moderately secure way is relation to other popular mobile OS's like iOS.