15 ms·
Tesla Car Hacked Remotely from Drone via Zero-Click Exploit
- deweller 5y agoTesla patched the vulnerabilities with an update pushed out in October 2020.
- aNoob7000 5y agoI believe it is part of the Pwn2Own hacking competition that contestants let the vendor know before releasing or talking about the exploit.
- nullifidian 5y agoDoes it matter? All these cars are still vulnerable, and state actors can probably kill you right now with a byte sequence -- investigators will find that you weren't using Autopilot properly. It's a sad state of things with no foreseeable solution.
- klmadfejno 5y agoState actors can kill you with a variety of common household items if they so desire.
- nullifidian 5y agokilling with a byte sequence is as effortless as it gets. And it's one of the more plausibly deniable ways to do it. Why create additional ways for state actors to kill people? They could at least add "Power off all modems" option to all cars, and stop relying on over the air updates.
- klmadfejno 5y ago> Why create additional ways for state actors to kill people? State actors can destroy buildings, so I guess we shouldn't make buildings /s. Or less sarcastically, state actors can compromise laptops, so I guess we should stop allowing "over the air" security patches to laptops? Should we just stop using computers? The reality is that state actors murdering people is an incredibly low risk threat. If state actor really want to kill someone, that is, assassinate someone, they can do it with a gun or a poison or whatever. If state actors casually want to kill one person, finding novel exploits is a pretty expensive way of doing it. If state actors want to kill a lot of people, you're basically at war, so we can use actual weapons.
- nullifidian 5y ago>Should we just stop using computers? Laptops and buildings are a necessity, while cars with wireless modems and always on internet connections are not. All the usecases are solvable with Apple/Android/Car with infotainment serving as a dumb terminal, without any connection to anything important in a car. Since we already always have government surveillance devices on us (mobile phones) why add additional ones, which have the ability to crush us into oncoming traffic? Cars also had perfectly functional navigation with SD cards. >"over the air" security patches to laptops? Yes. Over the air security patches are a very very bad thing. The fact that this issue still hasn't been solved is a disgrace, with all the formal verification advances. Still laptops are a necessity, and can't kill us directly. >State actors can destroy buildings, That's not very plausibly deniable method. Buildings don't collapse or blow up by themselves. It leaves lots of material evidence of foul play. >with a gun or a poison or whatever. Not if they want to avoid suspicions and make it look like it was something natural, which is almost all the time. >murdering people is an incredibly low risk threat. Not if you are an activist and are up against an authoritarian regime, which can even follow you abroad. There is also surveillance you can't turn off like you can with a phone -- i.e. you can't talk with people in a car about anything important.
- EricE 5y ago“Laptops and buildings are a necessity, while cars with wireless modems and always on internet connections are not.” Hear hear and well worth repeating. I’m waiting for the (probably not too distant) day when insurance companies demand access to car telemetry in order to obtain reasonable insurance rates. Tick Tock…
- jsight 5y agoExactly... if you are so valuable that they'd risk burning an exploit for an imperfect chance, there are more effective ways.
- nullifidian 5y agoWhat more effective ways? Send goons with chemical warfare agents? Nothing would happen with the exploit if it's done with a fake base station or through other low-range wireless thing.
- klmadfejno 5y ago> Send goons with chemical warfare agents? Literally yes.
- nullifidian 5y agoThat's not more effective, and much much more risky, and this method leaves evidence, while powered off or zeroed and rebooted dram contents don't.
- klmadfejno 5y agoThere's a low upper bound on efficacy. You can only kill someone once. Realistically both methods leave evidence. To do a code exploit you need to find something, sit on it hoping its upatched, and then hope nobody can figure out that you did it when they do their extensive analysis of why a car suddenly did something extremely rare and dangerous, else you lose the exploit.
- nullifidian 5y ago>car suddenly did something extremely rare and dang In absence of anything else, and cleaned up dram + fake logs is really an absence, it's always ascribed to driver oversight, distraction, loss of control. >Realistically both methods leave evidence. Yes, computing leaves "evidence" in form of heat(entropy).
- sjaak 5y agoThe future will be interesting. Imagine what havic you could wreak with a worm that is able to control a car (this worm was not). Let the worm spread for a while through the fleet and activate a malicious piece of code at a set moment that accelerates and steers the cars into an object. There's not enough medical personnel to tend to all these accidents. Total chaos. Am I wrong in thinking that with the passing of time the probability of such an event tends to 1?
- gorpomon 5y agoYou're not wrong, that scenario was in a Fast & Furious movie. I'm guessing it's something numerous parties are considering in some capacity.
- anotha1 5y agoYou're wrong. Computer "worms" as people think of them are not the problem here. They're actually well understood. And while propagation seems like it could be so fast it's overwhelming, I think there are a lot of reasons to consider that exceedingly unlikely. These "worms" are the equivalent of catching a communicable illness that is *physically manipulating* the car (even if it's just software). What's the bigger issue? Adversarial manipulation of the sensor inputs. This can be equated to verbal or visual manipulation in humans, something that becomes much harder to detect. While most of these attacks would be against a local target, I could also see a widespread deployment that goes unnoticed and slowly degrades many neural networks, and those being erroneously propagated. The latter is a much bigger problem than "worms" because it's effectively invisible. We can audit and identify malicious code, there's an entire industry built around that. But, neural networks are for the most part still a black box solution. How does one detect and solve manipulation in a black box solution? Well, maybe my Tesla will meet your Tesla in therapy and they can talk about it.
- xorfish 5y ago> "I think there are a lot of reasons to consider that exceedingly unlikely" What are those reasons?
- baybal2 5y ago> Intel was also informed since the company was the original developer of ConnMan, but the researchers said the chipmaker believed it was not its responsibility. ... Very strange position when Intel sinks 7 digit sums into salaries of top tier computer programmers working on it. Does it do it for nothing then? It's these situations when people can't tell what the heck they are doing what they do for for $200k a year which signal of company's dysfunction.
- boblivion 5y agoThey weren't the maintainers anymore. That's the reason. OSS is tricky sometimes in that regard.
- baybal2 5y agoConnman is maintained by Intel, it's pretty much nobody needs it, but them. It's desktop usage is abysmal with no GUI supporting its up to date API.
- LargoLasskhyfv 5y agoHm. While I usually avoid Wifi where- and whenever I can, recently I couldn't. Booted some live Distro into RAM, fiddled whith settings(because not used to WiFi, got it?), almost had screaming fits, until I discovered I could switch from that Networkmanagercrap to Connman and everything worked. The GUI which enabled that was this https://github.com/andrew-bibb/cmst https://github.com/andrew-bibb/cmst Where the use-case was a simple connect to that fucking T-Offline hotspot at the edge of reception and automagically point some browser tab to the captive portal, FAST! Also RECONNECT fast! That worked for me.
- baybal2 5y agoCMST is the most up to date GUI for connman, but the upstream is far ahead of current GUI features.
- ajross 5y ago
- radarsat1 5y agoI know little about Teslas, so: > A hacker who exploits the vulnerabilities can perform any task that a regular user could from the infotainment system. That includes opening doors, changing seat positions, playing music, controlling the air conditioning, and modifying steering and acceleration modes. However, the researchers explained, “This attack does not yield drive control of the car though.” Two things. I feel the title of the article should have included this information, eg. "Tesla Car's Infotainment System Hacked Remotely.." to make the headline a little less scary. Secondly, though, can someone explain how "modifying steering and acceleration modes" does not "yield drive control"? This sounds like it does affect the driving of the car.
- matt_s 5y agoA headline less scary gets less clicks. Clicks is money to them.
- WesolyKubeczek 5y ago> opening doors > changing seat positions > modifying steering and acceleration modes > However, the researchers explained, “This attack does not yield drive control of the car though.” These researchers must have a very unorthodox opinion on what driving safety actually is. Hint: it's not only about the driver's safety.
- fuzzy2 5y ago> Secondly, though, can someone explain how "modifying steering and acceleration modes" does not "yield drive control"? This sounds like it does affect the driving of the car. I have a car (2019 Seat Leon) with Dynamic Chassis Control. Modes are Eco, Normal, Comfort and Sport. Of these, only Eco really has any special characteristics like reduced acceleration. So while it may indeed affect how the car drives and steers, it’s nothing dramatic. I’m sure it’s relatively similar in a Tesla. But maybe I’m just numb. :-)
- spinny 5y agoIt might have some effect. On a car with electronic steering the drive mode changes how "heavy" the steering wheel feels, same for electronic suspensions (google drive-by-wire). my non expert assumption is that the wheels are controlled by some electronic system and the feedback provided through the steering wheel actuator.
- 988747 5y agoThat is why my next car will probably be vintage Corvette C1, from 1962. Zero electronics onboard.
- pudmaidai 5y agoThe chances of dying in an accident in a vintage car far exceed the chance of being hacked. Choosing to drive that car is fine, but definitely not “for safety”
- rataata_jr 5y agoI'm going to get a cheap econobox from 10 years ago. No new cars for me.
- GhostVII 5y agoPretty sure the increase in risk due to worse crash safety outweighs the lower risk of being hacked by about 5 orders of magnitude.
- rataata_jr 5y agoI ride motorcycles. So there's that.
- jjav 5y agoAbsolutely does not. 10 years ago is 2011, very recent. Every useful safety technology is already there, just no remote drive by wire exploits.
- mrtksn 5y agoNewer cars are extremely safe compared to the old cars. It's like night and day difference. In Cuba, I got a chance to ride on some 60's cars. Looks amazing but it's essentially a pretty metal can accelerated to highway speeds. There's no going back to pre-electronic, even pre-computers era if safety is a concern.
- 5y ago
- ACS_Solver 5y agoI've worked on autonomous driving / ADAS, and have read a few university lectures on related software engineering subjects. On one occasion, my presentation was followed by that of a military researcher whose job is basically to study new threats enabled by digital technology. To my surprise, the military researcher wasn't particularly concerned about software vulnerabilities in cars and similar vectors. We discussed some specific instances of remote car software exploits. His point was, in essence, that all cars with advanced software can potentially be exploited, but that it's not a real threat because all such exploits require special knowledge, equipment and money. For someone looking to assassinate a specific individual, there are far cheaper and simpler methods that are also more reliable, including several methods that involve physically tampering with a car. For someone who wants to cause mass chaos, such as attacking many vehicles in an area, the researcher estimates it requires the capabilities of a state actor or at least a large organization, and they also have cheaper and simpler ways to plunge a city into chaos.
- diamondhandle 5y agoThis sounds like an extremely naive and optimistic outlook. Large scale command and control situations are getting increasingly close to reality. Anyone who has followed US foreign policy and the like won’t be too surprised that this guy worked for the military (which is sad, really).
- ACS_Solver 5y agoThat's not the US military by the way - despite persistent rumors to the contrary, other countries do exist. I also find the outlook a bit optimistic admittedly, but there are definitely plenty of better targets than cars for a sophisticated actor. Car software is very different from model to model, and there's a large variety of models on the road - even if you can cause all cars of model X in an area to accelerate to dangerous speeds (something far beyond the capability of current exploits), that will only affect a small proportion of all cars in the area. It will undoubtedly cause chaos, but nothing on the scale you can get by attacking some weaker systems. Even a coordinated attack against traffic lights is easier to pull off and has no less potential damage.
- hellbannedguy 5y agoTesla is the last car I would try to steal. It can be rometely shut down? It can be found via gps information? Wealthy owners can afford Lowjack. (I actually don't know, and to lazy to research. Just going off stuff I've heard here.) If I had a big enough faraday cage, a flat bed, and winch; it might be an appealing target though? Oh yea, a lot of motorcycles are stollen by two guys lifting the bike onto a pickup--locks, and all.
- throwaway0a5e 5y agoYou document and report a vulnerability to Walmart, Northrop, some random BigCo that nobody thinks much about and you get nothing. You document and report an equivalent vulnerability to a tech BigCo and you make the front page of HN. It's not about having a working exploit you can monetize. These hackers aren't gonna steal cars. They're showcasing their skills and picking their targets for that purpose. Had they hacked a Daweoo wearing Chevy clothes or an FCA product nobody would blink twice. The comments would all be people saying you get what you pay for or repeating the typical Reddit tropes about the big3 being crap. They picked one of the brands that starts with T, ends with A because those brands are sacred cows of the upper middle class and have rabid online fan-bases who will greatly amplify and publicize these hackers work.
- justapassenger 5y ago> Had they hacked a Daweoo wearing Chevy clothes or an FCA product nobody would blink twice Jeep hack (part of FCA, that doesn’t exist anymore BTW - it’s Stellantis now) was a huge huge thing. https://www.bbc.com/news/technology-33650491 https://www.bbc.com/news/technology-33650491
- tyingq 5y agoThere's usually maintenance or "enthusiast" info available that makes it not that complex to defeat. Here's 2 antennas in a Model S mirror: https://teslamotorsclub.com/tmc/attachments/img_0748-jpg.21196/ https://teslamotorsclub.com/tmc/attachments/img_0748-jpg.211...
- dawnerd 5y ago
- bsanr2 5y agoIt has always upset me that development of vehicle software hasn't been aporoached with the same care and unyielding professionalism as that of the space shuttle. https://www.fastcompany.com/28121/they-write-right-stuff https://www.fastcompany.com/28121/they-write-right-stuff The software running our cars should be the most bulletproof in existence. Literally millions of lives hang in the balance.
- LinuxBender 5y agoIt has always upset me that development of vehicle software hasn't been aporoached with the same care and unyielding professionalism as that of the space shuttle. Maybe it has. Could it be that you could remotely hack the current space crafts, but nobody is allowed close enough for bluetooth to work?
- bsanr2 5y agoProbably not.
- davedx 5y ago“Tesla patched the vulnerabilities with an update pushed out in October 2020.” Begs the question, how or when did his hack take place given article is from this month? Unpatched Tesla?
- uKGgZfqqNZtf7Za 5y agoMost important sentence of the article IMO: However, the researchers explained, “This attack does not yield drive control of the car though.”
- EricE 5y agoSure - they can’t turn your car into the equivilent of an RC car but they don’t have to. Simply killing the engine while you are in the middle of traffic is more than enough to cause chaos, sew distrust in our infrastructure, etc.
- twobitshifter 5y agoThis headline is very cyberpunk and reminds me that we really do live in the future. When I was younger a “Tesla car” would have been Nikola Tesla’s rumored car that drew its power from the earth.
- amelius 5y agoWhat is so hard about putting all your services behind a port that requires proper encryption? Genuine question.
- csours 5y agoThe ALL part of all your services. General purpose computers do general things. As much as people say things like 'safety first' or 'security first' (do people even say security first?) it is quite clear that getting products to market is the priority. If you don't get to market, then security doesn't matter. As you add components to a computer enabled product, you add surface area vulnerable to attacks. This would indicate that you should have a small number of well designed and tested components, but remember your product does not exist in a vacuum, a competitor will release a product with more capabilities; customers cannot easily compare security, but they can easily compare a feature list and a price point.
- eingaeKaiy8ujie 5y agoI use ConnMan on my desktop. I wonder if there is something for me to worry about and if I should switch to NetworkManager.
- data_acquired 5y agoMy biggest fear with these scenarios is not really the hacking but law-enforcement agencies undermining civil rights by forcing Tesla or other self-driving car-makers to redirect cars against a customer's will. I feel like an episode of Westworld alluded to this scenario at some point. I come from a country where minorities have historically had a bad time at the hands of authorities, and I can see said authorities salivating at this prospect.
- gregoriol 5y agoCars can already be stopped when stolen, it has been available for many years I think, it's not about Tesla or self-driving. The new thing with some current and most future cars is that everything will be controlled by a computer that has software that is connected to internet and even Wi-Fi, which makes it prone to "computer hacks" we know so well. From that point, the problems being faced come from both worlds: car world (stealing, accident, ...) and computer world (access to location or cameras, ransomware, ...).
- data_acquired 5y agoThat's true. Do you know of prominent cases where law-enforcement abused the ability to remotely stop a car?
- spicybright 5y agoEither way, I'm sure police would push hard to stop any car chase, or sometimes simple pull overs I'd imagine.
- judge2020 5y agoFor reference: https://www.globenewswire.com/news-release/2019/12/17/1961557/0/en/Remote-Vehicle-Shutdown-Market-To-Reach-USD-723-65-Million-By-2026-Reports-And-Data.html#:~:text=Remote%20Vehicle%20Shutdown%20refers%20to,caused%20due%20to%20dangerous%20driving https://www.globenewswire.com/news-release/2019/12/17/196155....
- 5y ago
- Black101 5y agoMaybe one day car manufacturers will be required to tell you how to disconnect your car from wireless networks. Or even better, it will be illegal to opt you into them. (but I don't see any of those happening with the current government)
- EricE 5y agoit would be interesting to see if newer cars would even start if you removed/disabled the cellular radio.
- Black101 5y agoI have heard of some people that would just disable the antenna and haven't heard of starting issues.... but I have doubts about it being 100% effective. IE: Once I wrapped a wireless device in aluminum foil and it could still transmit... I think that to be 100% effective as a Faraday cage, it needs to be grounded too but of course it is a different story for an antenna but...
- Kognito 5y agoFascinating as the exploit itself is, it makes me wonder how long manufacturers will "support" these newer connected vehicles. Having an outdated smartphone is one thing, you risk your personal data being targeted if the manufacturer decides to no longer support it after a few years - but the risk seems much larger if you've got say, Teslas (though I'm sure it applies to most other vehicles these days), with unpatched, well documented vulnerabilities which could endanger the life of the occupants if exploited. The one saving grace here is perhaps "This attack does not yield drive control of the car"... I'd be fascinated to know what the separation of systems looks like in a modern connected vehicle. I'm assuming it's not likely to be physically possible to gain drive control of the vehicle through its infotainment system?
- w0mbat 5y agoIs navigation not part of the infotainment system? I'm imagining a hack that puts the empty parked car into self-driving mode and makes it drive away, effectively stealing itself.
- EricE 5y agoI hope to be buried with my 20+ year old cars that are NOT connected to the Internet with integrated cell phones. Egad :p
- antattack 5y agoTesla fixed the exploit in 2020 by replacing ConnMann with Dnsmasq.
- whydoyoucare 5y agoI would design a "kill switch" in the car that makes it a "dumb" car as in 1990s. In the event of a detected compromise, flip the switch and enjoy the drive!