5 ms·

If the OTA updates are compromised or some other remote vulnerability is found I'd consider that a major flaw. However, some of the Tesla "hacks" I've seen sho

If the OTA updates are compromised or some other remote vulnerability is found I'd consider that a major flaw. However, some of the Tesla "hacks" I've seen show up in the past involve plugging a laptop into the inside of the car. If you've got physical access to the inside of ANY car you can do some serious damage. Doesn't take a "l33t hax0r" to cut some brake lines or undo an oil pan plug.

untog 8y ago
I'd argue those aren't quite equivalent. If I was the passenger in a Tesla taxi I might be able to plug something in to add tracking software or who knows what to the car without the driver knowing. As autopilot improves I might be able to tell the car to up and drive over to my house in the middle of the night. Not exactly the same as cutting brake lines.
- danpalmer 8y ago
  The compute module is under the back seat in the Model 3 I believe. That's all of the major components, might be tricky but someone who doesn't care about damaging the seat may well be able to get in unnoticed while riding in a Tesla taxi.
  - Joky 8y ago
    It is behind the glovebox
  - gibolt 8y ago
    Is access to it lockable? Would be useful for a taxi usecase
    - billhathaway 8y ago
      In the model 3, the only way to access the glovebox is to press the button on the console. I'm sure this would be disabled when in self-driving taxi mode.
  - thebluehawk 8y ago
    It's in the dash. You have to remove the glovebox and several pieces of the dash. For some reason I think the taxi driver would notice you disassembling his car.
- hathawsh 8y ago
  FWIW, the Tesla model 3 has an internal camera (probably more than one) that Tesla probably plans to use to observe the occupants when in self-driving taxi mode. I think the camera would deter most high tech vandals.
  - sixstringtheory 8y ago
    Just remeber when you’re recording your dummy loop to play back while you pwn, make sure no flies land on the camera lens!
    - Fuckyourself 8y ago
      Someone watched too many movies...
ex3ndr 8y ago
Sorry, but you can't do anything with german cars (BMW, Audi and Mercedes) - everything is end-to-end encrypted. This is not the case for almost all other vendors that usually use unencrypted CAN bus.
- Latteland 8y ago
  This is simply not true. Here's a recent set of fixes - now because they don't have over the air updates or free ones, how many people will ever get their cars updated: "Researchers said they were able to combine the 14 flaws to escalate their access to the car's inner CAN bus". https://www.bleepingcomputer.com/news/security/bmw-fixes-security-flaws-in-several-well-known-car-models/ https://www.bleepingcomputer.com/news/security/bmw-fixes-sec...
  - ex3ndr 8y ago
    My bad, i thought that BMW is almost the same as Mercedes, it turns that it is not. Mercedes doesn't have such flaws by design - there are no writable connections from media and can bus to steering, engine, gearbox etc. And everything is encrypted there (unlike CAN). I expected that BMW is same as Mercedes (since they use same flexray chips), but it seems that BMW screwed up their setup.
- bri3d 8y ago
  Surprisingly little on VW AG CANbus is encrypted, I'm not sure where you're getting this idea. I haven't worked with BMW and Mercedes since around 2010 but I doubt they're much different. I have written my own ECU flashing tool for Simos18 as well as a message injection system for the VW/Audi MQB platform (similar to the commercially available PolarFIS product). Really the only protection at all is that ECU flash files are encrypted in transit (on dealer DVDs) and over the wire, but with a fixed AES key and IV which is present in plaintext on the flash once the file is written. The CAN gateway messages are generally not encrypted, both over the infotainment CANbus and the powertrain CANbus. Almost all cars are nearly completely insecure once you have interior physical access - which, IMO, is mostly OK as long as the bus wiring is in a reasonable location inaccessible to someone like a taxi passenger. What is more interesting is the prevalence of head units with wireless or remote access - over 3G, Bluetooth, and WiFi. Compromising these hosts (and then finding a pivot or escalation between the infotainment bus and the powertrain bus via the gateway) is an interesting attack vector.

untog 8y ago

I'd argue those aren't quite equivalent. If I was the passenger in a Tesla taxi I might be able to plug something in to add tracking software or who knows what to the car without the driver knowing. As autopilot improves I might be able to tell the car to up and drive over to my house in the middle of the night. Not exactly the same as cutting brake lines.

danpalmer 8y ago
The compute module is under the back seat in the Model 3 I believe. That's all of the major components, might be tricky but someone who doesn't care about damaging the seat may well be able to get in unnoticed while riding in a Tesla taxi.
- Joky 8y ago
  It is behind the glovebox
- gibolt 8y ago
  Is access to it lockable? Would be useful for a taxi usecase
  - billhathaway 8y ago
    In the model 3, the only way to access the glovebox is to press the button on the console. I'm sure this would be disabled when in self-driving taxi mode.
- thebluehawk 8y ago
  It's in the dash. You have to remove the glovebox and several pieces of the dash. For some reason I think the taxi driver would notice you disassembling his car.
hathawsh 8y ago
FWIW, the Tesla model 3 has an internal camera (probably more than one) that Tesla probably plans to use to observe the occupants when in self-driving taxi mode. I think the camera would deter most high tech vandals.
- sixstringtheory 8y ago
  Just remeber when you’re recording your dummy loop to play back while you pwn, make sure no flies land on the camera lens!
  - Fuckyourself 8y ago
    Someone watched too many movies...

ex3ndr 8y ago

Sorry, but you can't do anything with german cars (BMW, Audi and Mercedes) - everything is end-to-end encrypted. This is not the case for almost all other vendors that usually use unencrypted CAN bus.

Latteland 8y ago
This is simply not true. Here's a recent set of fixes - now because they don't have over the air updates or free ones, how many people will ever get their cars updated: "Researchers said they were able to combine the 14 flaws to escalate their access to the car's inner CAN bus". https://www.bleepingcomputer.com/news/security/bmw-fixes-security-flaws-in-several-well-known-car-models/ https://www.bleepingcomputer.com/news/security/bmw-fixes-sec...
- ex3ndr 8y ago
  My bad, i thought that BMW is almost the same as Mercedes, it turns that it is not. Mercedes doesn't have such flaws by design - there are no writable connections from media and can bus to steering, engine, gearbox etc. And everything is encrypted there (unlike CAN). I expected that BMW is same as Mercedes (since they use same flexray chips), but it seems that BMW screwed up their setup.
bri3d 8y ago
Surprisingly little on VW AG CANbus is encrypted, I'm not sure where you're getting this idea. I haven't worked with BMW and Mercedes since around 2010 but I doubt they're much different. I have written my own ECU flashing tool for Simos18 as well as a message injection system for the VW/Audi MQB platform (similar to the commercially available PolarFIS product). Really the only protection at all is that ECU flash files are encrypted in transit (on dealer DVDs) and over the wire, but with a fixed AES key and IV which is present in plaintext on the flash once the file is written. The CAN gateway messages are generally not encrypted, both over the infotainment CANbus and the powertrain CANbus. Almost all cars are nearly completely insecure once you have interior physical access - which, IMO, is mostly OK as long as the bus wiring is in a reasonable location inaccessible to someone like a taxi passenger. What is more interesting is the prevalence of head units with wireless or remote access - over 3G, Bluetooth, and WiFi. Compromising these hosts (and then finding a pivot or escalation between the infotainment bus and the powertrain bus via the gateway) is an interesting attack vector.