6 ms·

I feel like the better question is, how do you sell a stolen Tesla with features that require a near constant connection with Tesla? Maybe you sell it for part

by d33lio 6y ago

I feel like the better question is, how do you sell a stolen Tesla with features that require a near constant connection with Tesla? Maybe you sell it for parts, but even then most Tesla owners aren't the type of people to buy an entire battery pack or wheels from some online character.

boringg 6y ago
Seriously - this article is clickbaity. Security flaw + Tesla -> generate ad dollars and make people more skeptical of technology in the process. Not saying it isn't relevant but the likelihood of this happening in the wild?
- stuff4ben 6y ago
  This is Tesla/Elon fanboism at its finest here. How is the title clickbaity? The title says exactly what happened. Tesla took shortcuts, clear and simple. They didn't implement things like code signing and there's the implementation detail where they were using certificates, but oops, we don't actually check them. If this was Ford or Toyota having this type of security lapse, then people would be all over it. The likelihood of this happening in the wild is zip because Tesla is fixing it using the OTA capabilities which is great, and I give them credit for that. But don't underestimate the seriousness of this.
  - Retric 6y ago
    Requiring a thief both get within 15 feet of the key and know the VIN is way down on the list of known issues. Not to defend a Tesla but most car companies keyless entry features are as bad if not much worse. The only notable thing about this one is it’s over Bluetooth. Anyone wanting to steal a car can just roll up with a tow truck, so car companies don’t put a lot of effort into this stuff. Hell, I have done the got into someone else’s car sit down and realize it’s not my car. As in I unintentionally unliked the wrong car. I know of 2 other people who had similar experiences with different brands.
    - stuff4ben 6y ago
      Damn! Were you/they able to start the car?? Yes, I get that other automakers are bad, but my complaint to the parent commenter was more about the so-called click-baitiness of the title. And if you weren't able to start the car that you accidentally unlocked, then this Tesla vuln is technically more serious.
      - Retric 6y ago
        I didn’t try and start the car, the seat was in a very different position so I quickly noticed something was wrong. However, one of my friends did.
      - mikestew 6y ago
        Damn! Were you/they able to start the car?? When I was an auto mechanic back in the 90s, more than once I've pulled a car into a bay that wasn't the car I was supposed to work on. The keys matched, make and model matched, must be the one that needs an oil change. And, yes, I've changed the oil on a car that wasn't there for an oil change. It didn't happen but a handful of times over a few years, but it did occasionally happen. Does it happen with modern keyless entry? Dunno, I've been a software dev for the last 25 years.
    - snypher 6y ago
      Are you saying it makes it easier or harder? The VIN is right there on the windshield and a lot of people leave their keys within 15 feet of the outside/sidewalk/common areas.
      - Retric 6y ago
        It’s less secure than being able to start the car without access to the drivers key.
        Retric 6y ago
        *more
    - 6y ago
  - boringg 6y ago
    I don't care for Tesla or Elon much but I do pay attention to how media makes money. Tesla articles drive clicks which drive ad dollars. That model is frustrating and you get stories that are overblown which leads to more people disregarding stories and getting disenfranchised with publications.
    - stuff4ben 6y ago
      Fair enough, I get that sentiment regarding the media. Although I don't think this article warranted the click-bait accusation.
  - throwaway0a5e 6y ago
    People would give Toyota a pass. They'd praise Toyota's conservativeness in engineering and use that as an excuse for not being up to speed with modern security practices. It's the only other brand that gets as much fanboyism as Telsa. Ford, GM, Nissan, FCA for sure, would be raked over the coals in the comments though.
    - FireBeyond 6y ago
      Yup. Jeep had a potential OTA exploit and Tesla fans were here crowing about how "stupid" they were, and how only Tesla had done OTA "right".
piyh 6y ago
Why do you need to sell it? If you're the type of person to steal a car vis bluetooth, you can buy a cell jammer for cheap and have a new to you tesla, or drive it to your chop shop. Not every thief has the same motivations. This guy in PA kept his stolen Ferraris in his garage for years with the very rare weekend drive. https://www.youtube.com/watch?v=GFkvbdMYgHs https://www.youtube.com/watch?v=GFkvbdMYgHs
- jgalt212 6y ago
  reminds me of the Lamborghini barn find in Poland on Wheeler Dealers. http://wheelerdealers.discoveryuk.com/gallery/lamborghini-uracco/ http://wheelerdealers.discoveryuk.com/gallery/lamborghini-ur... https://en.wikipedia.org/wiki/Lamborghini_Urraco https://en.wikipedia.org/wiki/Lamborghini_Urraco I wonder how a party apparatchik obtained this one during the Cold War.
deeeeplearning 6y ago
Probably best not to underestimate the ingenuity of criminals.
stronglikedan 6y ago
I have a feeling this would be more popular with the joyriders than the fencers.
bluGill 6y ago
Parts is the typical reason to steal a car. Most modern cars cannot be hot wired easily, plus it is hard to get a clean title so the next owner can license the car. The parts of the car are valuable though. I suspect you are right about the value of Tesla parts though.
- bdamm 6y ago
  The challenge is that the most valuable parts of a Tesla, the battery pack and motors, have their own traceable electronic IDs. In the case of the Tesla Model 3/Y, the motors won't work without the VCSEC, the security controller from the car, which also needs an unlock sequence to activate. AFAIK separating the VCSEC from the motors is still an open research problem, as is unlocking the VCSEC without a key card. As for the battery, that also is traceable and necessarily so if the new operator wishes to use a Supercharger. A Tesla that can't supercharge is much less valuable than a Tesla that can, so that would be pretty hard to hide from the end user. A stolen battery ends up being a con job on the end buyer.
  - gamblor956 6y ago
    Those aren't the valuable parts though. With Teslas, the exterior parts (like the panels) are the most valuable, because those are the parts in shortest supply for the kind of work that third-party repair shops can handle. If you have an issue with the battery, that's not something a third-party shop can handle.
justapassenger 6y ago
I think parts could be pretty good reason. There’s a lot of people trying to repair/rebuild their cars. And Tesla makes it hard/impossible to get parts from them, which most likely increases demand for used parts. You can check stories from Rich Rebuilds about how hard Tesla makes it for people to work on those cars.

by d33lio 6y ago

boringg 6y ago

Seriously - this article is clickbaity. Security flaw + Tesla -> generate ad dollars and make people more skeptical of technology in the process. Not saying it isn't relevant but the likelihood of this happening in the wild?

stuff4ben 6y ago
This is Tesla/Elon fanboism at its finest here. How is the title clickbaity? The title says exactly what happened. Tesla took shortcuts, clear and simple. They didn't implement things like code signing and there's the implementation detail where they were using certificates, but oops, we don't actually check them. If this was Ford or Toyota having this type of security lapse, then people would be all over it. The likelihood of this happening in the wild is zip because Tesla is fixing it using the OTA capabilities which is great, and I give them credit for that. But don't underestimate the seriousness of this.
- Retric 6y ago
  Requiring a thief both get within 15 feet of the key and know the VIN is way down on the list of known issues. Not to defend a Tesla but most car companies keyless entry features are as bad if not much worse. The only notable thing about this one is it’s over Bluetooth. Anyone wanting to steal a car can just roll up with a tow truck, so car companies don’t put a lot of effort into this stuff. Hell, I have done the got into someone else’s car sit down and realize it’s not my car. As in I unintentionally unliked the wrong car. I know of 2 other people who had similar experiences with different brands.
  - stuff4ben 6y ago
    Damn! Were you/they able to start the car?? Yes, I get that other automakers are bad, but my complaint to the parent commenter was more about the so-called click-baitiness of the title. And if you weren't able to start the car that you accidentally unlocked, then this Tesla vuln is technically more serious.
    - Retric 6y ago
      I didn’t try and start the car, the seat was in a very different position so I quickly noticed something was wrong. However, one of my friends did.
    - mikestew 6y ago
      Damn! Were you/they able to start the car?? When I was an auto mechanic back in the 90s, more than once I've pulled a car into a bay that wasn't the car I was supposed to work on. The keys matched, make and model matched, must be the one that needs an oil change. And, yes, I've changed the oil on a car that wasn't there for an oil change. It didn't happen but a handful of times over a few years, but it did occasionally happen. Does it happen with modern keyless entry? Dunno, I've been a software dev for the last 25 years.
  - snypher 6y ago
    Are you saying it makes it easier or harder? The VIN is right there on the windshield and a lot of people leave their keys within 15 feet of the outside/sidewalk/common areas.
    - Retric 6y ago
      It’s less secure than being able to start the car without access to the drivers key.
      - Retric 6y ago
        *more
  - 6y ago
- boringg 6y ago
  I don't care for Tesla or Elon much but I do pay attention to how media makes money. Tesla articles drive clicks which drive ad dollars. That model is frustrating and you get stories that are overblown which leads to more people disregarding stories and getting disenfranchised with publications.
  - stuff4ben 6y ago
    Fair enough, I get that sentiment regarding the media. Although I don't think this article warranted the click-bait accusation.
- throwaway0a5e 6y ago
  People would give Toyota a pass. They'd praise Toyota's conservativeness in engineering and use that as an excuse for not being up to speed with modern security practices. It's the only other brand that gets as much fanboyism as Telsa. Ford, GM, Nissan, FCA for sure, would be raked over the coals in the comments though.
  - FireBeyond 6y ago
    Yup. Jeep had a potential OTA exploit and Tesla fans were here crowing about how "stupid" they were, and how only Tesla had done OTA "right".

piyh 6y ago

Why do you need to sell it? If you're the type of person to steal a car vis bluetooth, you can buy a cell jammer for cheap and have a new to you tesla, or drive it to your chop shop. Not every thief has the same motivations. This guy in PA kept his stolen Ferraris in his garage for years with the very rare weekend drive. https://www.youtube.com/watch?v=GFkvbdMYgHs https://www.youtube.com/watch?v=GFkvbdMYgHs

jgalt212 6y ago
reminds me of the Lamborghini barn find in Poland on Wheeler Dealers. http://wheelerdealers.discoveryuk.com/gallery/lamborghini-uracco/ http://wheelerdealers.discoveryuk.com/gallery/lamborghini-ur... https://en.wikipedia.org/wiki/Lamborghini_Urraco https://en.wikipedia.org/wiki/Lamborghini_Urraco I wonder how a party apparatchik obtained this one during the Cold War.

deeeeplearning 6y ago

Probably best not to underestimate the ingenuity of criminals.

stronglikedan 6y ago

I have a feeling this would be more popular with the joyriders than the fencers.

bluGill 6y ago

Parts is the typical reason to steal a car. Most modern cars cannot be hot wired easily, plus it is hard to get a clean title so the next owner can license the car. The parts of the car are valuable though. I suspect you are right about the value of Tesla parts though.

bdamm 6y ago
The challenge is that the most valuable parts of a Tesla, the battery pack and motors, have their own traceable electronic IDs. In the case of the Tesla Model 3/Y, the motors won't work without the VCSEC, the security controller from the car, which also needs an unlock sequence to activate. AFAIK separating the VCSEC from the motors is still an open research problem, as is unlocking the VCSEC without a key card. As for the battery, that also is traceable and necessarily so if the new operator wishes to use a Supercharger. A Tesla that can't supercharge is much less valuable than a Tesla that can, so that would be pretty hard to hide from the end user. A stolen battery ends up being a con job on the end buyer.
- gamblor956 6y ago
  Those aren't the valuable parts though. With Teslas, the exterior parts (like the panels) are the most valuable, because those are the parts in shortest supply for the kind of work that third-party repair shops can handle. If you have an issue with the battery, that's not something a third-party shop can handle.

justapassenger 6y ago

I think parts could be pretty good reason. There’s a lot of people trying to repair/rebuild their cars. And Tesla makes it hard/impossible to get parts from them, which most likely increases demand for used parts. You can check stories from Rich Rebuilds about how hard Tesla makes it for people to work on those cars.