4 ms·

Teen hacker finds bug that lets him control 25 Teslas remotely

30 points by carride 5y ago

phlhr 5y ago
Did anyone bother to check that this bug has nothing to do with Tesla before proudly announcing their EM hatred? It was a 3rd party app that asked users to hand over their email address and password.
- meepmorp 5y ago
  If you look at the linked article you'll find, right under the headline: > David Colombo says it's the owners' faults, not an infrastructure vulnerability. So, to answer your question, yes someone did bother to check.
- phlhr 5y ago
  I meant the commenters in this thread immediately starting their Tesla/Elon hate without knowing any of the details.
colesantiago 5y ago
Finally someone can actually implement the 1 million robotaxis we have been waiting for as Elon "promised".
toomuchtodo 5y ago
This was a vulnerability in the default Grafana config [1] of https://github.com/adriankumpf/teslamate https://github.com/adriankumpf/teslamate, which allows a Tesla owner to use the Tesla API on their own infra to log data from the vehicle. It appears Tesla deauthorized auth tokens en masse due to this [2]. [1] https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d https://github.com/adriankumpf/teslamate/commit/fff6915e7364... (relevant commit) [2] https://twitter.com/TezLabApp/status/1481180064926547969 https://twitter.com/TezLabApp/status/1481180064926547969
twiddling 5y ago
Does he have seed funding for a Tesla As A Service offering?
lrvick 5y ago
Exactly why no one could pay me enough to accept the attack surface of a centrally controllable proprietary self driving car, and I ride motorcycles. Imagine an attack like this one that did a supply chain attack on the next firmware update to all vehicles: https://arstechnica.com/information-technology/2018/02/tesla-cloud-resources-are-hacked-to-run-cryptocurrency-mining-malware/ https://arstechnica.com/information-technology/2018/02/tesla...
supperburg 5y ago
This headline is dishonest reporting honestly and I’m really saddened when I see ars technica do this. They chip away at the truth for a few clicks. To say a hacker is “controlling” an electric car means that he is driving it around and there is absolutely no other reasonable interpretation of that headline. So the headline imprints itself in the minds of thousands who never read the article where it says the hacker actually doesn’t control the car… ars gets their traction and Tesla has something stolen from them unjustly. It’s sickening. You can dislike Elon musk but when you are polluting the air with lies then you are just scum.

30 points by carride 5y ago

Did anyone bother to check that this bug has nothing to do with Tesla before proudly announcing their EM hatred? It was a 3rd party app that asked users to hand over their email address and password.

meepmorp 5y ago
If you look at the linked article you'll find, right under the headline: > David Colombo says it's the owners' faults, not an infrastructure vulnerability. So, to answer your question, yes someone did bother to check.
phlhr 5y ago
I meant the commenters in this thread immediately starting their Tesla/Elon hate without knowing any of the details.

colesantiago 5y ago

Finally someone can actually implement the 1 million robotaxis we have been waiting for as Elon "promised".

toomuchtodo 5y ago

This was a vulnerability in the default Grafana config [1] of https://github.com/adriankumpf/teslamate https://github.com/adriankumpf/teslamate, which allows a Tesla owner to use the Tesla API on their own infra to log data from the vehicle. It appears Tesla deauthorized auth tokens en masse due to this [2]. [1] https://github.com/adriankumpf/teslamate/commit/fff6915e7364f83b3030f980d5743299c4e5260d https://github.com/adriankumpf/teslamate/commit/fff6915e7364... (relevant commit) [2] https://twitter.com/TezLabApp/status/1481180064926547969 https://twitter.com/TezLabApp/status/1481180064926547969

twiddling 5y ago

Does he have seed funding for a Tesla As A Service offering?

lrvick 5y ago

Exactly why no one could pay me enough to accept the attack surface of a centrally controllable proprietary self driving car, and I ride motorcycles. Imagine an attack like this one that did a supply chain attack on the next firmware update to all vehicles: https://arstechnica.com/information-technology/2018/02/tesla-cloud-resources-are-hacked-to-run-cryptocurrency-mining-malware/ https://arstechnica.com/information-technology/2018/02/tesla...

supperburg 5y ago

This headline is dishonest reporting honestly and I’m really saddened when I see ars technica do this. They chip away at the truth for a few clicks. To say a hacker is “controlling” an electric car means that he is driving it around and there is absolutely no other reasonable interpretation of that headline. So the headline imprints itself in the minds of thousands who never read the article where it says the hacker actually doesn’t control the car… ars gets their traction and Tesla has something stolen from them unjustly. It’s sickening. You can dislike Elon musk but when you are polluting the air with lies then you are just scum.