21 ms·
The Big Tesla Hack: A hacker gained control over the entire fleet
- jaimex2 6y agoYou can really see how government intelligence agencies just go around hacking and dumping repositories of other governments and companies keeping what they find in their back pocket.
- arkadiyt 6y agoHere's Jason Hughes' annotated vulnerability writeup, which the article is about: https://docs.google.com/document/d/1yXni1GoD93q8mX-yom7JLBn0Q8tPOQz2A_y3m3LJi8o/edit https://docs.google.com/document/d/1yXni1GoD93q8mX-yom7JLBn0...
- forgotmypw17 6y agohttps://archive.is/rLJPU https://archive.is/rLJPU
- maxkwallace 6y agoThis was discussed/predicted a while back: https://news.ycombinator.com/item?id=16258336 https://news.ycombinator.com/item?id=16258336
- deleted 6y ago[deleted]
- bigiain 6y agohttps://medium.com/@mpesce/the-great-hack-part-one-attack-70c5f7b22f34 https://medium.com/@mpesce/the-great-hack-part-one-attack-70... "The first thing that happens is nothing. Your smartphone stays black while you swipe at it and press the various buttons. Has the battery gone flat? You could have sworn you left the house with a full charge. Now you start to wonder how you’ll get your car out of the parking structure without a working mobile. That thought hadn’t occurred to you before. It’s the least of your worries. Still fussing with your smartphone, you gradually begin to realise you’re not the only one having this problem. In fact, it would seem that everyone waiting at the pick-up area is in various stages of agitation with their own smartphones. Some are pressing odd combinations of buttons, trying to reset the little beasties. Others, who have clearly had rough days now made worse, start to swear at their dead screens, as if cursing might shock them into life. It’s weird, and almost a bit funny. For a brief moment. The first smashing can be felt more than heard, a subsonic strike something like a vast drumhead being struck with a metre-wide mallet, but so quick, you barely even notice it until it’s over. The second one, however, isn’t far behind, and it’s a bit louder. That second thump gives away its location — whatever it was seems to be happening quite close by — in the direction of the parking structure. At just this moment a car cruises through the pick-up zone at full speed, barreling along at least 100 kmh. It’s only because of some very fast reactions that no one gets hurt as it passes by. As it zooms past, you notice there’s no one behind the wheel. Before you have any time to process that, another huge thump nearby causes a section of the barrier wall of an upper floor of the concrete parking structure to shear off. A pile of rubble falls to the ground not very far away from you."
- philsnow 6y agoThis reminds me strongly of Daniel Suarez' book Daemon, https://amzn.com/0451228731 https://amzn.com/0451228731
- bigiain 6y agoYeah. That's a great read too.
- theamk 6y agoIt's pretty well written, but somewhat unrealistic from technical standpoint. The first part is OK (except author forgot about "fire exit" laws, so the mall doors would not be locked) The second part, the one which describes "consensus" system from technical standpoint, is wrong. The protection does not work this way. As in, it can surely be implemented, but it has no benefits that author claims and would not protect from stuxnet-like "viruses" (sic!) at all. The third part, where the bitcoin is mentioned, is outright science fiction.
- eganist 6y ago> The hacker shared the data on the Tesla Motors Club forum, and the automaker seemingly wasn’t happy about it. > Someone who appeared to be working at Tesla posted anonymously about how they didn’t want the data out there. > Hughes responded that he would be happy to discuss it with them. > 20 minutes later, he was on a conference call with the head of the Supercharger network and the head of software security at Tesla. > They kindly explained to him that they would prefer for him not to share the data, which was technically accessible through the vehicles. Hughes then agreed to stop scraping and sharing the Supercharger data. > After reporting his server exploit through Tesla’s bug reporting service, he received a $5,000 reward for exposing the vulnerability. What's the difference between this and what Uber's former Security Chief was charged with?
- GhostVII 6y agoThe hack you are talking about is unrelated to the one that let him control the Tesla network. In that one it sounds like he just put together a custom client that requested supercharger data from Tesla, which I wouldn't really consider hacking.
- femto 6y agoIsn't a "fleet-wide hack of autonomous vehicles" an oxymoron? They clearly aren't autonomous if they are controlled by an outside force that can be hacked. Maybe it depends on perspective, with the manufacturer seeing owners as outside forces, from which their vehicles are autonomous? Rolled up with the liability question is the question of who does control the vehicles and who they are autonomous from.
- judge2020 6y agoThe vehicles are autonomous when asked, such as if you click "summon" in the app. If they gained access to Mothership after summon was introduced (they accessed it in 2017, but summon came out in 2019[0]), it could have meant accessing a car and summoning it to attacker. 0: https://youtu.be/nlCQG2rg4sw https://youtu.be/nlCQG2rg4sw
- nostoc 6y agoThe car can know how to drive (be autonomous) and still receive instructions from a remote source. The car is autonomous but can't read your mind, you have to provide locations to drive to. These can come from a remote server.
- _underfl0w_ 6y ago"Autonomous" in this instance means "able to maneuver without a driver", not "able to make independent decisions without the help of an external system".
- yabones 6y agoThis is what holds me back from 'smart' devices that have the potential to cause real harm... We've been making motors (electric or combustion) for over a hundred years, and gotten pretty damn good at making them safe and reliable. Same thing with stoves, HVAC equipment, small appliances, etc. These are all mature technologies that we can practically trust our lives with. Internet-connected smart vehicles aren't a mature technology. Not in the sense of this being the win2k era of that tech, but that our assumptions about how to build these systems might be fundamentally wrong. I don't know if it will ever be safe enough to trust human lives to it. Until then, I'll only want to buy cars made before 2010.
- iRomain 6y agoI think the key here, and unfortunately most companies don't give a sh*t, is to allow the user to gain control over his device and/or take it offline if it pleases him. For example, a Tesla car should come with an option to disable any remote control features, or a way to control it over short distance only when it's offline (I don't know if its already the case, I don't have a tesla).
- judge2020 6y agoIt's not possible without rooting your car and losing the warranty. This is legal as long as you don't touch the odometer.
- Reelin 6y ago> rooting your car Something has gone terribly wrong with modern technology.
- Silhouette 6y agoI think the key here...is to allow the user to gain control over his device and/or take it offline if it pleases him. I wonder how long it will be before we start to see legal or regulatory interventions in this area. Mandatory self-updating and phone-home functionality is rapidly infecting technologies we rely on every day, from our cars to our home computers to our TV sets. This always-connected, always-updated approach inevitably introduces some risks. It often causes intrusions into privacy or brings changes after purchase that users of these technologies don't necessarily want. Competition in these markets is evidently insufficient to provide alternatives for those who don't want anything to do with this modern culture. I don't believe that is limited to a small group of eccentric tinfoil-hat fans any more. Hopefully it won't take some sort of widespread disaster to wake the politicians up to the dangers here, though given the past performance of the political class around the world when it comes to technology issues, I'm not particularly optimistic.
- bookshelf11 6y agoThe pricing on these bug bounties always blows my mind. If this hack had been exploited Tesla market capitalization would've taken a multi-million if not billion dollar hit. And here they are, paying out relative chump change to a guy that alerted them to it.
- salty_biscuits 6y agoMaybe, maybe not. What happened to Garmin's share price?
- amanzi 6y agoHow is that even remotely similar?
- bookshelf11 6y agoGreat question. I think I'd say the big difference is that people, for the most part, aren't putting their/others lives in Garmin's hands when they use their devices. That said, I think they have some hiking/trekking oriented products which could cause problems if you were relying on them. The headline "electric car fleet hacked" is a lot scarier than "smart watches hacked". Then again, maybe people really don't give a shit about this stuff, and these bounties are priced correctly.
- deleted 6y ago[deleted]
- Aeolun 6y agoI think, if this had been abused, Tesla would be out of business. But the fact that $50000 is chump change for Tesla does not mean it's chump change to the recipient.
- falcolas 6y agoIt's funny, we always talk about compensating leaders for the value they provide to the company. Yet when it comes to non-leaders, it's transforms into a question of "value relative to their current/recent income".
- tw04 6y agoI hope this serves as a reminder to everyone here that THIS is why you should have a physical disconnect switch. I should be able to pull a breaker to disable self driving on my Tesla when I’m not using it.
- manquer 6y agoUnless there is regulation in no automaker is going to do it themselves.
- tempsy 6y agoTake anything from Electrek with a big grain of salt - they are the publication of choice for controlled leaks from Tesla.
- driverdan 6y agoThis is another reason why I think it's incredibly foolish to own a vehicle with an internet connection. Even if the vehicle doesn't support remote control like Tesla there may be a chain of bugs that could be used to do just that or cause other problems. That's not even considering the major privacy issues that come with such vehicles.
- perl4ever 6y agoI remember a long time ago reading about the updates to mandated car electronics and thinking I never wanted to own a car newer than...1996 maybe? And now I can't even remember what I was thinking and why. It might have been OBD-II. Even a hard core luddite gets worn down.
- driverdan 6y agoThere's a difference between local computer control and remote control. I prefer an ECU to all mechanical engines. I'm not a luddite. I understand the security and privacy implications of always on internet connected GPS tracking and remote control.
- perl4ever 6y agoSure, but ECUs existed before OBD-II. Obviously even OBD existed prior. Those standards are about communication and control.
- 0xFFC 6y agoYeap, pretty accurate. I can predict it is going to get bad. It is always fascinating to me that companies invest billions in everything aesthetic related. But when it comes to security and system software, no money!
- novok 6y agoShit like this is why cars need to be functional without cellular / wifi access, and updates impossible without the user pressing a button, along with direct connection to the the car for features like summon. Which is pretty much the opposite like Tesla operates.
- sneak 6y ago> Also, Tesla owners will supposedly soon get two-factor authentication for their Tesla account. This was the biggest line in the story, for me. You can spend $100k+ on a vehicle and you can’t even have security to protect it that was standard FIVE YEARS AGO. Lack of 2FA is a showstopper for services an order of magnitude less expensive than a vehicle. Tesla simply must not care about security very much, a fact reflected in their low bug bounty prices.
- simple_bot 6y agoFun world to live in
- jayd16 6y agoSo how do vulnerabilities like this happen these days? I just work in games and everyone still knows having an API that takes a user ID (in this case the VIN) is asking to get abused. Is the description just a gross oversimplification of the hack or was Tesla security really that bad?
- csours 6y agoIt seems like a classic case of mistaking (or not taking seriously enough) the difference between authentication and authorization. He accessed the server through the car's VPN, so there was an authenticated and authorized connection to the server. However, an authorized connection to the server is not authorization to make any arbitrary request on the server. It happens for the same reason that many games get MAX_INT high scores at launch.
- cnst 6y agoNow imagine someone takes over your Neuralink... And that's how we get the Zombie Apocalypse, kids!
- bolasanibk 6y agoThe Feed (https://en.m.wikipedia.org/wiki/The_Feed_(British_TV_series) https://en.m.wikipedia.org/wiki/The_Feed_(British_TV_series)) is based on this premise.
- slimsag 6y agoPretty misleading to omit ", but fortunately he’s a good guy" in the title
- sellyme 6y agoI think it's reasonable to expect people to intuit that "A malicious hacker gained control over the entire Tesla fleet" would be a much bigger deal than a couple hundred points on HN. No cars currently being located in my living room is a pretty big giveaway, for one.
- totetsu 6y agoand that it was in 2017
- Tijdreiziger 6y agoDoes it matter? Next time it might not be a good guy.
- spsful 6y agoIn the context of headlines, maybe. It seems a little more pessimistic with this omission.
- burfog 6y agoSomeday, all cars from a particular brand will be made to crash during rush hour. The carnage will be immense. Emergency services will have to go off-road to bypass the snarl. There won't be enough helicopters to meet the demand. The brand that could cause the most damage is probably Bosch, a major automotive component manufacturer.
- jxurueydyys 6y agoAn easy solution would be to not allow self driving or remotely updated cars until there's a reliable solution to this. People already go to auto-shops for repairs, certified auto-shops could easily double as places to update software and the certification requirements can be tailored to require an external oversight agent come and evaluate their security practices.
- freeopinion 6y agoCertified autoshops are a solution in the same way that Norton is a solution for PC malware. Problem solved?
- jxurueydyys 6y agoThe difference is that the pc is exposed to everything it interacts with including the internet while the car would only be interacting with shops that were meeting their certification obligations. Tying updates to physical locations also reduces the severity of a successful bad actor since most people in a city don't all go to the same auto-shop. A problem like a nation-wide cyber attack on vehicles is only possible if we allow personal vehicles to support the attack vector.
- throwaway0a5e 6y agoI don't see how certification solves anything that just not doing OTA updates doesn't also solve.
- 6y ago
- altdatathrow 6y agoHaving a fleet of cars you can manage with a single ansible script isn’t the norm for $400B companies?
- jgalt212 6y agoIt's funny you say that, and there are shops that are very careful with this sort of stuff. Unfortunately, I fear that when the big cloud hack comes, it's going to hurt everyone (i.e. those with and without publicly addressable S3 buckets).
- chadlavi 6y agoCan y'all add "in 2017" to the title here?
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- Someone1234 6y agoThis article is from three days ago (August 27th, 2020). I suspect the underlying issue was under a 3 year NDA/agreement. It would be misleading to label an article from three days ago from "2017," particularly as this is the first reporting about this ever.
- judge2020 6y ago> (I will note, I was never barred from disclosing any of this publicly in any way. As a courtesy, I felt it would be the right thing to do to hold off on public disclosure for a while, potentially indefinitely. Years later, it seems worthwhile to disclose this information and highlight just how far things have come and how Tesla's software security has improved dramatically since then.) From https://news.ycombinator.com/item?id=24327485 https://news.ycombinator.com/item?id=24327485, so no NDA.
- chadlavi 6y agoI'm not saying add "(2017)" I'm saying clarify that the hacker gained the control 3 years ago, not just now.