5 ms·
So how do vulnerabilities like this happen these days? I just work in games and everyone still knows having an API that takes a user ID (in this case the VIN)
by jayd16 6y ago
So how do vulnerabilities like this happen these days? I just work in games and everyone still knows having an API that takes a user ID (in this case the VIN) is asking to get abused. Is the description just a gross oversimplification of the hack or was Tesla security really that bad?
- csours 6y agoIt seems like a classic case of mistaking (or not taking seriously enough) the difference between authentication and authorization. He accessed the server through the car's VPN, so there was an authenticated and authorized connection to the server. However, an authorized connection to the server is not authorization to make any arbitrary request on the server. It happens for the same reason that many games get MAX_INT high scores at launch.