3 ms·

Do we think Tesla looks at these? Looks like at leasthe first handful require code execution privileges initially which is hopefully preventing most of the dama

by gleenn 3y ago

Do we think Tesla looks at these? Looks like at leasthe first handful require code execution privileges initially which is hopefully preventing most of the damage.

ghewgill 3y ago
At least two of them are marked as "DISPUTED", so presumably yes, Tesla does respond to them.
createdapril24 3y ago
Tesla not only looks at these, they coordinate their fixes and disclosure. Tesla runs a bug bounty program https://bugcrowd.com/tesla https://bugcrowd.com/tesla, contracts with security research companies to audit its vehicles, has a security researcher program where they share more access & documentation for researchers who have helped improve vehicle security, and put up both vehicles and cash in pwn2own. Obtaining code execution, persistence, or privilege escalation on a Tesla is a formidable challenge. Pwn2own went many years without there being any compromise of the vehicle, and last year's compromise was done by a firm that dedicated a lab and team of people for more than 6 months.
- rossjudson 3y ago
  The (ahem) road to this state is probably littered with lessons learned. I'm hopeful that Tesla will share that history, allows its people to write about it, and let the wider community generalize and learn. There's a lot more than cars out there.
- deleted 3y ago
  [deleted]
NegativeK 3y ago
CVEs are the very basics of published security vulnerabilities. Any company that makes software with at least one person who claims to do security will very likely be paying attention to these; Tesla is more than that, so they're going to be doing a lot more. That said, neither CVSS scores, security researchers, nor security teams are perfect. Some reports will be marked as won't fix, some teams won't publish vulnerabilities as CVEs, and some CVEs will be wildly inaccurate. But yes; they're going to pay attention to them.

by gleenn 3y ago

Do we think Tesla looks at these? Looks like at leasthe first handful require code execution privileges initially which is hopefully preventing most of the damage.

ghewgill 3y ago

At least two of them are marked as "DISPUTED", so presumably yes, Tesla does respond to them.

createdapril24 3y ago

Tesla not only looks at these, they coordinate their fixes and disclosure. Tesla runs a bug bounty program https://bugcrowd.com/tesla https://bugcrowd.com/tesla, contracts with security research companies to audit its vehicles, has a security researcher program where they share more access & documentation for researchers who have helped improve vehicle security, and put up both vehicles and cash in pwn2own. Obtaining code execution, persistence, or privilege escalation on a Tesla is a formidable challenge. Pwn2own went many years without there being any compromise of the vehicle, and last year's compromise was done by a firm that dedicated a lab and team of people for more than 6 months.

rossjudson 3y ago
The (ahem) road to this state is probably littered with lessons learned. I'm hopeful that Tesla will share that history, allows its people to write about it, and let the wider community generalize and learn. There's a lot more than cars out there.
deleted 3y ago
[deleted]

NegativeK 3y ago

CVEs are the very basics of published security vulnerabilities. Any company that makes software with at least one person who claims to do security will very likely be paying attention to these; Tesla is more than that, so they're going to be doing a lot more. That said, neither CVSS scores, security researchers, nor security teams are perfect. Some reports will be marked as won't fix, some teams won't publish vulnerabilities as CVEs, and some CVEs will be wildly inaccurate. But yes; they're going to pay attention to them.