11 ms·
Exploiting Wi-Fi Stack on Tesla Model S
- solotronics 7y agoWould having a Rust based embedded OS help with attacks such as this?
- explorigin 7y agoTechnically interesting and also interesting that this comes from Tencent. > Tencent Holdings Limited is a Chinese multinational conglomerate holding company founded in 1998, whose subsidiaries specialise in various Internet-related services and products, entertainment, artificial intelligence and technology both in China and globally.
- netsharc 7y agoI'd say it's no different to Google Project Zero. Of course since it's China, there'd be worries. I'd guess the Chinese government also employs crack hackers, like the NSA probably does?
- monocasa 7y agoYeah, but they don't share 0 days like this, just like the NSA doesn't.
- close04 7y agoFrom the article: > Responsible disclosure > All the two vulnerabilities we presented above are reported to Tesla in March 2019. Tesla already fixed them in version 2019.36.2, and the Marvell also has deployed a fix and published a security advisory[4] to the issue. The disclosure of the vulnerability research report had been communicated to Tesla, and Tesla is aware of our release.
- monocasa 7y agoRight... They shared the 0 day. NSA and Comment Crew just sit on them like a dragon hording gold.
- rrdharan 7y agoI believe it’s less black and white than that - all of these organizations have both offensive and defensive priorities and sometimes choose to disclose exploits publicly after calculating their remaining value. See e.g. https://foreignpolicy.com/2017/09/25/is-the-nsa-doing-more-harm-than-good-in-not-disclosing-exploits-zero-days/ https://foreignpolicy.com/2017/09/25/is-the-nsa-doing-more-h... https://www.npr.org/sections/alltechconsidered/2017/11/17/564755961/government-outlines-when-it-will-disclose-or-exploit-software-vulnerabilities https://www.npr.org/sections/alltechconsidered/2017/11/17/56...
- solarkraft 7y ago> Of course since it's China, there'd be worries. I could imagine the government siphoning off the more valuable exploits.
- deleted 7y ago[deleted]
- kccqzy 7y agoIf you read the Apple product security announcements you'll find that they (as well as Qihoo 360) has been finding security vulnerabilities in unaffiliated companies' products for a long time. It's not unusual. They probably got the inspiration from Project Zero though.
- saagarjha 7y agoTencent has a number of security teams in addition to Keen Lab that have been around for a while: Xuanwu for example. I believe Keen Lab itself is some sort of acquisition of Keen Team, which did independent security research.
- hwj 7y agoWith this "wardriving" gets a whole new meaning ;)
- natch 7y agoThe MCU is pretty well decoupled from any driving controls other than helping to display a bit of info like the speedometer. I mean it can even be rebooted anytime while driving. So I suspect the larger effect would be on things like entertainment features. Not really driving. But yes harhar, nice play on words.
- AgloeDreams 7y agoWell.. that and GPS and all the worries about logging long term GPS location data, user info and mics and so on. Not a crash risk but could totally be exploited for nasty means. Plus you could falsify data too.
- thomaskcr 7y agoThere's a CAN bus gateway service listening on a UDP port for commands. MCU can write to CAN in addition to read from it (albeit not all operations).
- cjbprime 7y agoIt sounds like you missed that the exploit wasn't in the MCU. That's not the system the wifi chip's connected to.
- natch 7y agoHmm ic, thanks.
- e2le 7y agoI'm not sure why firefox thinks I need DRM enabled to play the video on there.
- Shivetya 7y agoGood to see at end all were reported and acted upon before release.
- cjbprime 7y ago> As Linux Kernel 2.6.36 does not support NX Does the Model S really run 2.6.36, first released ten years ago? I'm sure they're using a stable branch and keeping up with security patches in general [1], but that's still shocking to me. [1]: although not 100% of security patches are going to end up in the stable@ queue or have their effect on 2.6.36 considered.
- stopads 7y agoThere are many 10+ year old linux kernels in embedded devices all over the place, and much less secure systems and services on top of that. It's often called the internet of shitty things.
- cjbprime 7y agoRight, but it's surprising that Tesla would be one of those vendors since they have an ongoing obligation to the security of their devices. It looks like their open source disclosure of the kernel source is a 4.4 kernel, so something weird is going on there. Maybe they got off 2.6 since the time the vulnerability was discovered? I see something saying they moved to 4.4 in the 8.1 update in June 2017, which is confusing because it suggests the vulnerability was never live. But I also see they have multiple CPUs running Linux and don't update the kernel on all of them at the same time, so perhaps the CPU running the 8686 driver wasn't updated?
- deleted 7y ago[deleted]
- stopads 7y agoA former Tesla software engineer posted a thread on twitter a few months ago describing their development/release process and it was a total mess of hacky bad practices that barely worked at all. It does not seem like software is much of a priority for them.
- erikpukinskis 7y ago
- castratikron 7y agoSo this exploit is not specific to Tesla but rather any Linux 2.6.36 (and maybe up) that uses the 88W8688 (and maybe others), which could be a pretty common combination. And all that's required is an AP running the exploit, everything is automatic. Very impressive.
- cjbprime 7y agoDefinitely a common combination. The OLPC XO-1.5 was using this hardware 10+ years ago. It sounds like NX protections defeat the attack, and it looks like they went in soon after this kernel, around 2.6.38.
- jandrese 7y agoTo be fair, that is a 10 year old kernel at this point.
- jchw 7y agoQ: How come Teslas are running kernels from 2008?
- cjbprime 7y agoIt appears that: Tesla bought this all-in-one ARM board from Parrot, and Parrot gave them a 2.6.36 kernel with thousands of custom patches in, and Tesla's not in much of a position to port it to a newer kernel, and then Parrot presumably went on to building other stuff and ignored keeping this kernel up to date and now we're here. They (probably Parrot) might have updated it in the last year since the vulnerability was discovered though, it's hard to tell.
- NullPrefix 7y agoIf it's not in mainline kernel - it's abandonware.
- punnerud 7y agoBy only connecting Tesla to AP with PMF (encrypted management frames) enabled, this exploit would not work? Because then you can not force a reconnect to AP using Deauthenticate frames. The problem is more explained here in a recent HN post: https://news.ycombinator.com/item?id=21889837 https://news.ycombinator.com/item?id=21889837
- stefan_ 7y agoThe DEAUTH thing is entirely incidental to the fully remote kernel code execution exploit chain.
- punnerud 7y agoI can agree on the Deauth, though it would maybe make it less receiptable to automated attack. I see that Action frames also is encrypted and verified when enable PMF, so it is still viable to avoid the exploit?
- avisaven 7y agoIf you find WiFi-based attacks on devices to be interesting, you may be interested in the following research from Google Project Zero on attacking the iPhone’s WiFi stack (and linked are articles on Android): https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl...
- AviationAtom 7y agoWas I the only one to notice the scrolling phallus doing things on the the status line for "waiting for Telsa to join our AP" on the article's attached video?
- jaimex2 7y agoPatched already but good to know if you're restoring a write off.