5 ms·
From the article > Tesla offers a “Root access program” on their bug bounty program. Researchers who find at least one valid “rooting” vulnerability will recei
by varenc 7mo ago
From the article
> Tesla offers a “Root access program” on their bug bounty program. Researchers who find at least one valid “rooting” vulnerability will receive a permanent SSH certificate for their own car, allowing them to log in as root and continue their research further.
Pretty interesting. Sounds like Apple's Security Research Device Program[0], where you're loaned a rooted iPhone, but with a clear qualification criteria.
It strikes a nice balance, because to qualify you have to 1) show you have the skills to get root access anyway and 2) show you're willing to participate in the bug bounty program and get things patched.
I would of course love root on everything I own, but I can understand Tesla's motivation here since root for everyone would make vulnerability discovery easier for malicious actors. And if everyone had root on their Tesla, it'd be much easier to make naughty modifications that might catch the ire of regulators. (like disabling driver attentiveness checks in self-driving mode).
[0] https://security.apple.com/research-device/ https://security.apple.com/research-device/
- xyzzy123 7mo agoHaving shell is extremely handy for further discovery. SO handy that if they were just gonna patch the bug and lock you out, you would simply not disclose it.
- freerobby 7mo agoThis is what happened. Tesla security received tons of bug reports that required root access to identify, yet they got a vanishingly small number of root vulnerability reports. This policy fixes that misincentive.
- fomine3 7mo agoIf they don't give root, researcher may have incentive to keep vuln secret for root access. Looks reasonable.
- EquallyJust 7mo agoIt's a mixed bag. This only applies to the infotainment system and not the autopilot computer. They've also revoked certificates from researchers personal cars in the past
- wett 7mo agoFWIW, I think they share resources. I was able to crash the browser via a GPU benchmarking website while using autopilot. Autopilot disengaged and the “instrument cluster” lit up like a Christmas tree for a few seconds. So I’d imagine an infotainment exploit would be able at least DOS the AP system.
- jordanb 7mo ago> Researchers who find at least one valid “rooting” vulnerability will receive a permanent SSH certificate for their own car It feels like this is something you should get by being owner of the car, and not have to do free speculative research for the manufacturer to get it.
- CalRobert 7mo agoAs much as I tend to agree philosophically, could it not result in people making changes that endanger other road users?
- jazzyjackson 7mo agoI don’t think that’s the reason, seeing as a car is already endangering everyone around it by existing. More likely about keeping the tooling to diagnose issues proprietary and expensive.
- auggierose 7mo agoObviously, they are both very good reasons. Just because you don't like one of them, doesn't mean the other one doesn't suddenly exist anymore.
- UqWBcuFx6NV4r 7mo agoYou could screenshot this and put it under the definition of “perfect being the enemy of good”
- chneu 7mo agoNo, one can do that anyway. There is basically no real way to stop folks from modifying their cars. It can be made more difficult, sure. This is about selling tools and access. It's another profit pipeline for car OEMs.
- dr_kiszonka 7mo agoPerhaps it is also about liability. Otherwise, we would have people installing OpenClaw on their Teslas.
- dostick 7mo agoThat’s quite a weak confidence in their own platform security if finding a root level vulnerability is not one-off event, but it’s a program expected to have multiple people routinely finding those.
- unglaublich 7mo agoWell it's a selection bias. If an athlete breaks a world record, they're likely to do it again. Even though it's incredibly hard to break a world record.
- noosphr 7mo agoImagine having to hack your device, then having to submit a request to actually own it.
- otabdeveloper4 7mo agoThe interesting part is this implies that Tesla cars have static certifcates that don't rotate. (Whoops.)
- worthless-trash 7mo agoWhy can't they rotate ? having root ssh keys on the device doesn't imply the certs don't rotate.
- bdavbdav 7mo agoNot necessarily. All they have to do is roll a pub key into the update package. Same as any OTA update.
- dotancohen 7mo agoDo Tesla vehicles get VIN-specific updates?
- bdavbdav 7mo agoNot sure - if I was designing it, feels like it would be a good way of getting the right build to the right car so that all the HW versions of each module are in line.
- dotancohen 7mo agoI'd imagine that the update includes all the possible hardware, and the update script actually decides which components to use. Like apt on Debian or yum on RHEL.
- bdavbdav 7mo agoInteresting - just found this: https://www.pentestpartners.com/security-blog/reverse-engineering-the-tesla-firmware-update-process/ https://www.pentestpartners.com/security-blog/reverse-engine... Not had a chance to read it properly but definitely will be!
- Traster 7mo agoAnd as we all know, if you're smart enough to get root access, your neighbours children playing football in the street should be subject to the risk of you driven a car that claims to have full self driving with custom code on it.