7 ms·
Security researchers collect awards for Tesla exploits at Pwn2Own Automotive
- obblekk 3y agoTesla software has such a large surface area to attack compared to traditional OEMs where most subsystems are effectively air gapped. It’s their advantage when it comes to coordinated user experience, but might become a problem as the fleet size increases and becomes a more valuable hacking target. I could see security becoming a bigger part of CarPlay/Android auto’s pitch to OEMs.
- berkes 3y ago> the fleet size increases and becomes a more valuable hacking target. Tesla has a (IMO rediculous) high market cap and stock value. A severe hack could affect that, which, combined with a short position, would allow attackers to make a large amount of money. What I'm saying is: Tesla already is a valuable hacking target.
- pid-1 3y agoI've been waiting for a cybersecurity incident to move markets since forever. It seems consumers and investors don't really care.
- jacooper 3y agoIt has to be really severe, like not being to drive your own car for multiple days because of a hack, which needs to be directly caused by their crappy security and not accidental
- berkes 3y agoIt has happened. E.g. the WannaCry attack back in 2017, moved markets severely. Short and most bounced back, but attacks do cause panic. The good(?) news is that e.g. WannaCry took out large, "boring" companies, like Maersk, or MSD. These companies typically have a low Alpha, low volatility, and people invest in them for long term: decades rather than weeks. Whereas with e.g. Tesla, every fart that Elon makes has an effect on the stocks.
- perihelions 3y agoThe SEC's Twitter hack was just a few days ago, https://news.ycombinator.com/item?id=38932228 https://news.ycombinator.com/item?id=38932228 According to one of the comments: "The price of BTC initially jumped 3% on the hacked tweet. That's $25bn+ of market cap."
- webdoodle 3y agoThe SolarWinds hack at the end of 2020 cut SWI from ~$25 to $15 a share in very short order. Pun intended.
- pclmulqdq 3y agoSolarWinds was a cybersecurity company, so a hack causes people to fundamentally question things. Tesla, on the other hand, doesn't need cars to get hacked for them to self-drive people into barriers or emergency vehicles, and the stock price isn't touched when yet another person dies. Why would a hack change anything?
- casercaramel144 3y agoBecause from a safety perspective, the amount of distracted / drunk / texting drivers who would've otherwise crashed their cars vs the amount of Tesla autopilot caused crashes is one for every 5.89 million miles (from their own website) vs about 500k for humans. From a purely pragmatic perspective, Tesla's that occasionally and irregularly crash are a way better alternative than terrible human drivers.
- berkes 3y ago"hacking tesla" is much broader than crashing a car that's self driving. It's lifting secret keys that allow criminals to open any Tesla 'till an OTA update, or callback has been rolled out. For days exposing your Tesla+luggage to theft. Or just breaking stuff: imagine the flack of every tesla driver suddenly losing access to navigation or entertainment for weeks. Or camera access: imagine the outrage if hackers can record and publish anything done and said inside and around Teslas in the last months?
- jjav 3y ago> combined with a short position While I don't disagree that Tesla is a valuable attack target, the reality is that for market value security does not matter. There can be a massive attack on Tesla announced tomorrow, the stock will go down 5% for a few days and recover within a month. Nobody cares. It's a depressing reality.
- geraldhh 3y agoyea, someone would have to spread a trojan in the playstore that constantly broadcasts a dos-inducing message from phones to really make a dent
- some_random 3y agoIt would be extremely difficult to get away with this, there's a reason why the SEC twitter account hack targeted bitcoin rather than a traditional stock.
- newsclues 3y agoAre trad auto OEMs going to maintain their advantage or will they rapidly follow Tesla ? If they try to emulate Tesla without the experience making it secure they could be even worse
- phpisthebest 3y agoI dont know if you can say that about traditional OEMs BEV's which seem to be following the Telsa model of complete interconnectivty of all systems traditional OEMs do not make a EV that is just a ICE with Electric Motor and battery, the traditional OEMs BEV platforms are completely redesigned to put in "features" that no one wants, and no one asked for to enable OEM control over every part of the car, enable them to turn features on and off in software and OTA (you know so they can make your pay monthly for your heated seats)
- cookiengineer 3y ago> air gapped Good joke. Have you seen any of the stolen cars because of CAN Bus security flaws lately? Nothing is air gapped. The Android entertainment system running 4.0 because of 32MB RAM requirements is fully connected to the CAN bus. It's a safety nightmare.
- Klathmon 3y agoNot even just lately, I remember around 2010 it was found that at least one car model could be exploited through the TPMS (tire pressure sensors)
- TheLoafOfBread 3y agoYes but there is more than 1 CAN bus network and they are isolated from each other via gateway. So you can't just take control over infotainment and start poking into brakes. Messages won't get routed through the GW.
- geraldhh 3y agoafaik this is true for some models.
- hgjbfubv 3y agoConsidering they literally had to latch onto the specific canbus to do that it means that you can’t just hack the head unit and expect to cutoff the engine. Not saying it can’t be done, but many manufacturers put in gateways to prevent that kind of thing.
- drtgh 3y agoThey are not doing it well then, https://www.propelex.com/hacking-cars-remotely-with-vin-number/ https://www.propelex.com/hacking-cars-remotely-with-vin-numb...
- mavhc 3y agoSays they needed 3 zero day bugs to get room on the modem, nothing about controlling any other part of the system How come other cars aren't submitted to Pwn2Own?
- lcfcjs 3y ago[dead]
- deleted 3y ago[deleted]
- geraldhh 3y ago> I could see security becoming a bigger part of CarPlay/Android auto’s pitch to OEMs. way to go since it became common for cars to constantly broadcast wifi and bt beacons from unpatched software stacks
- latexr 3y ago[flagged]
- tokai 3y agoIts nice to have if you are researching exploits for it I guess.
- drtgh 3y agoTo win for to receive their hardware and debug their crappy software for free at time you pay the maintenance costs. Professionals are not going to take the bait. I can imagine the manager who conceived it being proud of himself without being aware of the damage to the company's credibility (lowcost development).
- Galanwe 3y agoI would have more trust in a car that is subject to these challenges and get security fixes, than an unchallenged brand.
- palata 3y agoI would have more trust in a car that is not connected to the internet, period.
- titzer 3y agoWelcome to our dumb dystopia. Like a 90s hacker action flick, but with crappier graphics and tools with even worse functionality.
- Astronaut3315 3y agoAre there any such cars left? You’d probably have to pull the SIM on any modern vehicle to accomplish that.
- zvmaz 3y ago"I would have more trust in a demonstrably hackable car than in one that is not."
- mk89 3y agoScary to think that your car can get hacked. As if driving a 1200kg at 80km/h was not "dangerous" enough for people around.
- addandsubtract 3y agoThe inverse is just as "dangerous", though. - Imagine relying on a closed source app to drive a car - Imagine relying on some blinking lights on the dashboard to drive a car - Imagine relying on your hands and feet to drive a car It all boils down to driving being dangerous in general. You have to put your trust somewhere - and also trust that other people's trust and self-awareness align with yours.
- drtgh 3y agoThe ability to disconnect wireless should be mandatory, and done via a hardware switch.
- palata 3y agoWhen will we learn that connecting everything is a bad idea? Of course companies will connect everything if it brings profit. Customers should not buy connected products if there is not a really good reason to have them connected.
- padjo 3y agoBeing able to remotely enable the heating on freezing days is more than enough justification for connecting my car to the internet for me.
- palata 3y agoEven if it means that your car can be targeted by a ransomware or worse, hacked in such a way that it won't brake next time? Imagine a situation where your whole country is stopped because of a cyberattack. No car, no truck (maybe no fridge for those that bring food into your city), no emergency vehicle. Will it still be time at that point to realise that spending a few minutes in a cold car was not worth it? I guess that's my point: people choose base on "how much more convenient is it vs how much more expensive?" where security should be part of it. Somehow people seem to think that "security is under control". It is not: even BigTech gets hacked all the time.
- foobarian 3y agoFreezing weather already happens 3 months out of the year for me. But the cyber attack thing has not happened and tbh probably won't. Seems like a reasonable calculus then. It's similar to premature optimization or overengineering stuff at work. There is no need to overdo it.
- palata 3y ago> But the cyber attack thing has not happened and tbh probably won't. You mean because you live in a country that has never been (and probably won't ever be) unstable or targeted by someone? Have you ever heard of NotPetya and its global consequences (which could have been much worse, to be honest)? We are connecting more and more critical stuff to the Internet, pretending that security is not an issue. That is a problem. > It's similar to premature optimization or overengineering stuff at work. There is no need to overdo it. Sure, I agree that there is no need to overdo it. Now if we need to talk about the state of the software industry, I feel safe in saying that most work is "underdone" these days. I haven't had an issue of premature optimization in a long time, but I have issues of "very bad code thrown out there without care" on a daily basis. Similarly, being paranoid and doing nothing because of security concerns is probably not the right way. But not caring about security at all is on the other extreme :-).
- CamelCaseName 3y agoFor future readers, as of 9:08am EST, TSLA is up 1.49% in pre-market to $212.25 (Note: Earnings are set to be released after hours today)
- asynchronous 3y agoLeave it to hackernews to somehow find a way to badmouth Tesla for actually having a fantastic bug bounty program, and taking security seriously enough to sponsor multiple pwn2own events and other security challenges. Face it, Tesla has some of the best security practices in the industry, straight up.
- geraldhh 3y agootoh might be that tesla's have the only software stack that makes sense to subject to such a bug bounty because it is built from common oss that already has a target audience at these events. hence the criticism targeting the laziness in building a car with the same components used for mvp webshit
- two_handfuls 3y agoOh good, they still have security bounties and they still pay. That’s good news really.
- KristineRodman 3y ago[dead]