7 ms·

Tesla: Security Vulnerabilities

79 points by nixass 3y ago

gleenn 3y ago
Do we think Tesla looks at these? Looks like at leasthe first handful require code execution privileges initially which is hopefully preventing most of the damage.
- ghewgill 3y ago
  At least two of them are marked as "DISPUTED", so presumably yes, Tesla does respond to them.
- createdapril24 3y ago
  Tesla not only looks at these, they coordinate their fixes and disclosure. Tesla runs a bug bounty program https://bugcrowd.com/tesla https://bugcrowd.com/tesla, contracts with security research companies to audit its vehicles, has a security researcher program where they share more access & documentation for researchers who have helped improve vehicle security, and put up both vehicles and cash in pwn2own. Obtaining code execution, persistence, or privilege escalation on a Tesla is a formidable challenge. Pwn2own went many years without there being any compromise of the vehicle, and last year's compromise was done by a firm that dedicated a lab and team of people for more than 6 months.
  - rossjudson 3y ago
    The (ahem) road to this state is probably littered with lessons learned. I'm hopeful that Tesla will share that history, allows its people to write about it, and let the wider community generalize and learn. There's a lot more than cars out there.
  - deleted 3y ago
    [deleted]
- NegativeK 3y ago
  CVEs are the very basics of published security vulnerabilities. Any company that makes software with at least one person who claims to do security will very likely be paying attention to these; Tesla is more than that, so they're going to be doing a lot more. That said, neither CVSS scores, security researchers, nor security teams are perfect. Some reports will be marked as won't fix, some teams won't publish vulnerabilities as CVEs, and some CVEs will be wildly inaccurate. But yes; they're going to pay attention to them.
deleted 3y ago
[deleted]
anonporridge 3y ago
One of the underrated benefits of having hoards of haters, is that they'll work feverishly to find and yell about any and all of your flaws and weakness, for free. Those who don't have any haters have to pay for that valuable information, and still end up left wondering if the feedback is too soft.
- u320 3y ago
  What it the evidence that this is what happened here?
- slowhadoken 3y ago
  Yeah it’s free QA
  - frosting1337 3y ago
    Nah, they have a bug bounty program, people get paid for their bugs. Probably one of the better things Tesla do is their attitude towards bug hunters.
- demondemidi 3y ago
  "hoard of haters" If you're not repulsed by Musk, you haven't been paying attention. He is an abhorrent human being, antisemite, conspiracy theorist, anti-human rights, philandering, anti-free speech, billionaire troll. Every one of those claims has citations based in reality. Sorry to burst your bubble.
  - alsodumb 3y ago
    I had to read OP's comment again just to make sure I wasn't missing anything - what part of his comment made you go off like this? Burst his bubble? of what?
    - __s 3y ago
      I think they read "hoard of haters" like "basket of deplorables"
aftbit 3y ago
Does a Tesla owner have root on their own vehicle, or is that privilege kept for the masters at the mothership?
- schiffern 3y ago
  Selling a car with intentional root access would almost certainly be illegal in the USA, and most places. Cars have government-mandated safety features, and manufacturers are forbidden from adding kill switches. Selling a car with (manufacturer-sanctioned) root access would be legally the same as including a kill switch letting the owner disable safety features. If an owner cuts their brake light wires to flee the cops, it's 100% on them. If a manufacturer included a switch for it, they'd be in massive trouble.
  - mthomasmw 3y ago
    Is there a list of "kill switches encoded in law autos can't make" somewhere? I know the vehicle data recorder, and I've heard that LTE radios have to report occupancy, though I can't find a requirement that cars need an LTE radio. There's rumors cars will be mandated to support remote deactivation, but the story is unclear: https://www.usatoday.com/story/news/factcheck/2023/01/19/fact-check-false-claim-bill-mandates-kill-switch-cars-police-drunk-driving/11066287002/ https://www.usatoday.com/story/news/factcheck/2023/01/19/fac... relevant: https://consumerwatchdog.org/sites/default/files/2019-07/KILL%20SWITCH%20%207-29-19.pdf https://consumerwatchdog.org/sites/default/files/2019-07/KIL...
    - deleted 3y ago
      [deleted]
  - drdaeman 3y ago
    It can be argued that root access is not any kind of switch on its own. You have physical access either way - cutting a wire or reprogramming a EEPROM is already a kill switch, root access doesn't add to it, as long as manufacturer doesn't provide a script or otherwise encourages you to `kill -9 safetyprocess` or something. Unless it's mandated by law that there must be anti-circumvention features (components checking system integrity, DRM-like), which root access would actually contradict. But that'd be completely different from prohibition to introduce a kill switch. That'd be a legal requirement that a vehicle or some of its parts mustn't be user-serviceable. Root access is not a way to break stuff, even though it can be (ab)used as such - it's most certainly not its primary use case. It's a maintenance feature, enabling rightful owner to be able to diagnose, maintain and enhance their own vehicle's software without resorting to hacks. I'm sure that most people would use that to tweak their multimedia console (like adding CarPlay support) or get more diagnostic info about some failure they're facing, not hack their engine control module in some illegal way.
Rygian 3y ago
Those are really low EPSS.
port515 3y ago
I love the one that opens the charge port door. Use a $350 gadget with a chunk of time to set it up, or just rip it open with a screwdriver and pop it shut.
- yellow_lead 3y ago
  Yep, this is the one that you can exploit using a Flipper Zero. Working as intended per Tesla > * DISPUTED * Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended.
  - denysvitali 3y ago
    To be fair it makes sense that it works as intended: that specific frequency is used in home chargers and Superchargers to avoid the hassle of opening the charging port via the app / the car. The only difference with your own transmitter is that you can open the charging port from further away - which is just fun as you can eventually use a screwdriver to do the same
jaimex2 3y ago
Wonder why the other vendors are listed as having none. HackerOne says there have been hundreds reported and most car vendors can't OTA patch.
hnburnsy 3y ago
Physical access = game over?

79 points by nixass 3y ago

Do we think Tesla looks at these? Looks like at leasthe first handful require code execution privileges initially which is hopefully preventing most of the damage.

ghewgill 3y ago
At least two of them are marked as "DISPUTED", so presumably yes, Tesla does respond to them.
createdapril24 3y ago
Tesla not only looks at these, they coordinate their fixes and disclosure. Tesla runs a bug bounty program https://bugcrowd.com/tesla https://bugcrowd.com/tesla, contracts with security research companies to audit its vehicles, has a security researcher program where they share more access & documentation for researchers who have helped improve vehicle security, and put up both vehicles and cash in pwn2own. Obtaining code execution, persistence, or privilege escalation on a Tesla is a formidable challenge. Pwn2own went many years without there being any compromise of the vehicle, and last year's compromise was done by a firm that dedicated a lab and team of people for more than 6 months.
- rossjudson 3y ago
  The (ahem) road to this state is probably littered with lessons learned. I'm hopeful that Tesla will share that history, allows its people to write about it, and let the wider community generalize and learn. There's a lot more than cars out there.
- deleted 3y ago
  [deleted]
NegativeK 3y ago
CVEs are the very basics of published security vulnerabilities. Any company that makes software with at least one person who claims to do security will very likely be paying attention to these; Tesla is more than that, so they're going to be doing a lot more. That said, neither CVSS scores, security researchers, nor security teams are perfect. Some reports will be marked as won't fix, some teams won't publish vulnerabilities as CVEs, and some CVEs will be wildly inaccurate. But yes; they're going to pay attention to them.

deleted 3y ago

[deleted]

anonporridge 3y ago

One of the underrated benefits of having hoards of haters, is that they'll work feverishly to find and yell about any and all of your flaws and weakness, for free. Those who don't have any haters have to pay for that valuable information, and still end up left wondering if the feedback is too soft.

u320 3y ago
What it the evidence that this is what happened here?
slowhadoken 3y ago
Yeah it’s free QA
- frosting1337 3y ago
  Nah, they have a bug bounty program, people get paid for their bugs. Probably one of the better things Tesla do is their attitude towards bug hunters.
demondemidi 3y ago
"hoard of haters" If you're not repulsed by Musk, you haven't been paying attention. He is an abhorrent human being, antisemite, conspiracy theorist, anti-human rights, philandering, anti-free speech, billionaire troll. Every one of those claims has citations based in reality. Sorry to burst your bubble.
- alsodumb 3y ago
  I had to read OP's comment again just to make sure I wasn't missing anything - what part of his comment made you go off like this? Burst his bubble? of what?
  - __s 3y ago
    I think they read "hoard of haters" like "basket of deplorables"

aftbit 3y ago

Does a Tesla owner have root on their own vehicle, or is that privilege kept for the masters at the mothership?

schiffern 3y ago
Selling a car with intentional root access would almost certainly be illegal in the USA, and most places. Cars have government-mandated safety features, and manufacturers are forbidden from adding kill switches. Selling a car with (manufacturer-sanctioned) root access would be legally the same as including a kill switch letting the owner disable safety features. If an owner cuts their brake light wires to flee the cops, it's 100% on them. If a manufacturer included a switch for it, they'd be in massive trouble.
- mthomasmw 3y ago
  Is there a list of "kill switches encoded in law autos can't make" somewhere? I know the vehicle data recorder, and I've heard that LTE radios have to report occupancy, though I can't find a requirement that cars need an LTE radio. There's rumors cars will be mandated to support remote deactivation, but the story is unclear: https://www.usatoday.com/story/news/factcheck/2023/01/19/fact-check-false-claim-bill-mandates-kill-switch-cars-police-drunk-driving/11066287002/ https://www.usatoday.com/story/news/factcheck/2023/01/19/fac... relevant: https://consumerwatchdog.org/sites/default/files/2019-07/KILL%20SWITCH%20%207-29-19.pdf https://consumerwatchdog.org/sites/default/files/2019-07/KIL...
  - deleted 3y ago
    [deleted]
- drdaeman 3y ago
  It can be argued that root access is not any kind of switch on its own. You have physical access either way - cutting a wire or reprogramming a EEPROM is already a kill switch, root access doesn't add to it, as long as manufacturer doesn't provide a script or otherwise encourages you to `kill -9 safetyprocess` or something. Unless it's mandated by law that there must be anti-circumvention features (components checking system integrity, DRM-like), which root access would actually contradict. But that'd be completely different from prohibition to introduce a kill switch. That'd be a legal requirement that a vehicle or some of its parts mustn't be user-serviceable. Root access is not a way to break stuff, even though it can be (ab)used as such - it's most certainly not its primary use case. It's a maintenance feature, enabling rightful owner to be able to diagnose, maintain and enhance their own vehicle's software without resorting to hacks. I'm sure that most people would use that to tweak their multimedia console (like adding CarPlay support) or get more diagnostic info about some failure they're facing, not hack their engine control module in some illegal way.

Rygian 3y ago

Those are really low EPSS.

port515 3y ago

I love the one that opens the charge port door. Use a $350 gadget with a chunk of time to set it up, or just rip it open with a screwdriver and pop it shut.

yellow_lead 3y ago
Yep, this is the one that you can exploit using a Flipper Zero. Working as intended per Tesla > * DISPUTED * Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended.
- denysvitali 3y ago
  To be fair it makes sense that it works as intended: that specific frequency is used in home chargers and Superchargers to avoid the hassle of opening the charging port via the app / the car. The only difference with your own transmitter is that you can open the charging port from further away - which is just fun as you can eventually use a screwdriver to do the same

jaimex2 3y ago

Wonder why the other vendors are listed as having none. HackerOne says there have been hundreds reported and most car vendors can't OTA patch.

hnburnsy 3y ago

Physical access = game over?