[HN Gopher] Tesla: Security Vulnerabilities
___________________________________________________________________
Tesla: Security Vulnerabilities
Author : nixass
Score : 53 points
Date : 2023-12-03 16:58 UTC (6 hours ago)
(HTM) web link (www.cvedetails.com)
(TXT) w3m dump (www.cvedetails.com)
| gleenn wrote:
| Do we think Tesla looks at these? Looks like at leasthe first
| handful require code execution privileges initially which is
| hopefully preventing most of the damage.
| ghewgill wrote:
| At least two of them are marked as "DISPUTED", so presumably
| yes, Tesla does respond to them.
| createdapril24 wrote:
| Tesla not only looks at these, they coordinate their fixes and
| disclosure. Tesla runs a bug bounty program
| https://bugcrowd.com/tesla, contracts with security research
| companies to audit its vehicles, has a security researcher
| program where they share more access & documentation for
| researchers who have helped improve vehicle security, and put
| up both vehicles and cash in pwn2own.
|
| Obtaining code execution, persistence, or privilege escalation
| on a Tesla is a formidable challenge. Pwn2own went many years
| without there being any compromise of the vehicle, and last
| year's compromise was done by a firm that dedicated a lab and
| team of people for more than 6 months.
| rossjudson wrote:
| The (ahem) road to this state is probably littered with
| lessons learned. I'm hopeful that Tesla will share that
| history, allows its people to write about it, and let the
| wider community generalize and learn. There's a lot more than
| cars out there.
| NegativeK wrote:
| CVEs are the very basics of published security vulnerabilities.
| Any company that makes software with at least one person who
| claims to do security will very likely be paying attention to
| these; Tesla is more than that, so they're going to be doing a
| lot more.
|
| That said, neither CVSS scores, security researchers, nor
| security teams are perfect. Some reports will be marked as
| won't fix, some teams won't publish vulnerabilities as CVEs,
| and some CVEs will be wildly inaccurate. But yes; they're going
| to pay attention to them.
| anonporridge wrote:
| One of the underrated benefits of having hoards of haters, is
| that they'll work feverishly to find and yell about any and all
| of your flaws and weakness, for free.
|
| Those who don't have any haters have to pay for that valuable
| information, and still end up left wondering if the feedback is
| too soft.
| u320 wrote:
| What it the evidence that this is what happened here?
| slowhadoken wrote:
| Yeah it's free QA
| frosting1337 wrote:
| Nah, they have a bug bounty program, people get paid for
| their bugs. Probably one of the better things Tesla do is
| their attitude towards bug hunters.
| demondemidi wrote:
| "hoard of haters"
|
| If you're not repulsed by Musk, you haven't been paying
| attention. He is an abhorrent human being, antisemite,
| conspiracy theorist, anti-human rights, philandering, anti-free
| speech, billionaire troll. Every one of those claims has
| citations based in reality. Sorry to burst your bubble.
| alsodumb wrote:
| I had to read OP's comment again just to make sure I wasn't
| missing anything - what part of his comment made you go off
| like this? Burst his bubble? of what?
| __s wrote:
| I think they read "hoard of haters" like "basket of
| deplorables"
| ThrowawayTestr wrote:
| Musk Derangement Syndrome
| qarl wrote:
| I agree. The similarities between the two are striking.
| ls612 wrote:
| Texas Man Bad -> Orange Man Bad -> Rocket Man Bad
|
| American culture in the past 20 years in one line.
| qarl wrote:
| The pattern is pretty obvious, isn't it? You'd think
| they'd learn.
| ThrowawayTestr wrote:
| And the ability of their haters to make every discussion
| about how bad man is bad.
| qarl wrote:
| Yes. Agreed. It is very obviously very similar.
| mullingitover wrote:
| I don't know if "Lots of black hats loathe my vehicle's
| manufacturer and want to do it harm, and potentially by proxy
| _me_ ," is as beneficial as you're making it out to be.
|
| > they'll work feverishly to find and yell about any and all of
| your flaws and weakness, for free.
|
| This is a very questionable assumption. I don't see why a black
| hat who manages to pwn Tesla is going to then turn around and
| responsibly report the vuln they're using instead of doing
| maximum damage to the brand, potentially endangering lives of
| drivers, or selling their 0-day to some other malicious actor.
| taf2 wrote:
| I'm definitely a Tesla fan.. considering a cyber truck but
| one concern I have which I think is similar to what your
| saying is I'm worried because it's been demonstrated as
| bullet proof what if someone I drive by decides to test it
| out ?
| idiotsecant wrote:
| The idea that the cyber truck is 'bylletproof' is
| laughable. 3mm of stainless sheet does not start defying
| physics when you sprinkle Tesla marketing on it. Low energy
| pistol rounds designed for minimal penetration might be
| stopped but I wouldn't bet your life on it
| kiba wrote:
| I have seen video of it. It's 'bulletproof' for what they
| shot at it, which includes handgun, shotgun, and a tommy
| gun.
|
| I wouldn't rely on it as an armored vehicle. If I want
| extra protection, then I would spend money on uparmoring
| it.
| dun44 wrote:
| Perhaps you shouldn't put so much trust in marketing
| videos.
|
| https://www.quora.com/How-thick-of-a-hardened-steel-
| plate-do...
| ponector wrote:
| Without tests with AR-15 it is simply half-true
| marketing. but Tesla is full of such statements, like
| full self driving or price including gas savings.
|
| Toyota should do same marketing tricks with new Prius.
| nickthegreek wrote:
| They shot the windows?
| pclmulqdq wrote:
| Depending on the ammunition type, those guns all stand
| out as having very low penetration.
|
| Starting with the handgun, the two most popular calibers
| are 9 mm and .45, and if you shoot hollow point rounds,
| they can even be stopped by a few inches of drywall
| (hollow points are designed to expand on contact), and
| lead bullets may also be stopped by the truck if they are
| shot at an angle, but I wouldn't be sure about high-
| penetration rounds like full metal jacket. The Tommy gun
| is also handgun-caliber (assuming they shelled outout a
| small fortune to rent a real one, .45).
|
| Shotguns have an even wider variety of available
| projectiles. A shotgun shooting buckshot has far lower
| kinetic energy behind each projectile than a handgun, and
| their velocity falls off very quickly with increased
| range. A slug (a solid chunk of metal) designed for armor
| penetration, on the other hand, will penetrate 3 mm of
| steel easily, with similar caveats about range.
| mikeyouse wrote:
| Especially since those weirdly conceived 'bulletproof'
| windows went out the window and it's just normal glass so
| much of the vehicle profile is entirely susceptible to
| small arms fire.
| haliskerbas wrote:
| Shhh they don't have a marketing department, there is no
| marketing!!!! /s
| grecy wrote:
| > _what if someone I drive by decides to test it out ?_
|
| Where do you live that you actually worry about someone
| shooting your vehicle while you're out driving?
|
| Wherever it is, you need to leave if that is a valid
| concern.
| ponector wrote:
| Sounds like a random US city for me. Are you suggesting
| to move to Europe?
| mensetmanusman wrote:
| Tommy gun - nonproblemo
|
| AK47 - accelerate
| neilv wrote:
| Excellent points. And these hackable vehicles are powerful
| enough in the physical word to be "kinetic" weapons.
|
| So we should expect the exploit market to include buyers for
| assassinations (of occupant or person on the street),
| extortion ("every hour that the Bitcoin aren't transferred,
| we will take over one of your customer's vehicles in an
| extremely tragic way, and later we will tell the news media
| that you declined to prevent it"), economic sabotage, market
| moving, terrorism, and warfare.
| fiddlerwoaroof wrote:
| I wonder how bad this is compared to the competition.
| https://comma.ai allows you to add self-driving features to
| a large number of non-Tesla cars so, if we're including
| physical firmware hacks as a threat vector, I'd bet tons of
| alternative cars (new enough Honda Odysseys, Toyota
| Siennas, etc: probably anything with adaptive cruise
| control and lane following) have the same sort of potential
| vulnerability.
| mullingitover wrote:
| Probably depends on how online the car is. The always-
| online, always able to receive manufacturer firmware
| updates aspect of Teslas is probably the most risky part.
| I don't worry about anyone hijacking my Civic remotely.
| fiddlerwoaroof wrote:
| It might be risky in theory, but hasn't firmware signing
| on Apple Devices and other such devices basically shown
| that we can do this safely?
| mullingitover wrote:
| It can be done safely, but if Tesla is compromised and
| their attackers gain access to their network and their
| signing keys, all bets are off.
|
| I would bet that there are multiple unfriendly nation
| states who have intelligence groups persistently looking
| for ways to penetrate vital networks and secrets, like
| Tesla's, just to have the option of causing pandemonium
| if they wish to.
| frosting1337 wrote:
| Tesla has a decent bug bounty program - the haters get paid.
|
| Source: I'm a paid hater. :)
| hutzlibu wrote:
| The downside is stronger, if your buisness modell depends on
| people not knowing your flaws. Like a promised full self
| driving, that cannot do full self driving, but rather has
| serious flaws, capable of killing people:
|
| https://arstechnica.com/tech-policy/2023/11/elon-musk-and-te...
| FireBeyond wrote:
| There's a certain sense of martyrdom around Tesla.
|
| But I think that has nothing to do with this. Tesla has, for
| better or worse, one of the most "connected" vehicle systems.
| There are things I don't miss in my car, but I certainly like
| other things.
|
| That just makes it a bigger target. Attack surface and all
| that, more opportunities.
|
| It doesn't have to be about "the haters".
| aftbit wrote:
| Does a Tesla owner have root on their own vehicle, or is that
| privilege kept for the masters at the mothership?
| schiffern wrote:
| Selling a car with intentional root access would almost
| certainly be illegal in the USA, and most places.
|
| Cars have government-mandated safety features, and
| manufacturers are forbidden from adding kill switches. Selling
| a car with ( _manufacturer-sanctioned_ ) root access would be
| legally the same as including a kill switch letting the owner
| disable safety features.
|
| If an owner cuts their brake light wires to flee the cops, it's
| 100% on them. If a manufacturer included a switch for it,
| they'd be in massive trouble.
| mthomasmw wrote:
| Is there a list of "kill switches encoded in law autos can't
| make" somewhere?
|
| I know the vehicle data recorder, and I've heard that LTE
| radios have to report occupancy, though I can't find a
| requirement that cars need an LTE radio.
|
| There's rumors cars will be mandated to support remote
| deactivation, but the story is unclear: https://www.usatoday.
| com/story/news/factcheck/2023/01/19/fac...
|
| relevant: https://consumerwatchdog.org/sites/default/files/20
| 19-07/KIL...
| drdaeman wrote:
| It can be argued that root access is not any kind of switch
| on its own. You have physical access either way - cutting a
| wire or reprogramming a EEPROM is already a kill switch, root
| access doesn't add to it, as long as manufacturer doesn't
| provide a script or otherwise encourages you to `kill -9
| safetyprocess` or something.
|
| Unless it's mandated by law that there must be anti-
| circumvention features (components checking system integrity,
| DRM-like), which root access would actually contradict. But
| that'd be completely different from prohibition to introduce
| a kill switch. That'd be a legal requirement that a vehicle
| or some of its parts mustn't be user-serviceable.
|
| Root access is not a way to break stuff, even though it can
| be (ab)used as such - it's most certainly not its primary use
| case. It's a maintenance feature, enabling rightful owner to
| be able to diagnose, maintain and enhance their own vehicle's
| software without resorting to hacks. I'm sure that most
| people would use that to tweak their multimedia console (like
| adding CarPlay support) or get more diagnostic info about
| some failure they're facing, not hack their engine control
| module in some illegal way.
| schiffern wrote:
| You can argue to NHTSA, sure. You'll lose.
|
| NHTSA forced Tesla to do a recall because the in-car
| computer let the owner play audio on top of ("obscuring")
| the pedestrian warning tone.[0] If the in-car computer
| allowed them _root access_ , they'd have an aneurysm. ;)
|
| A rooted car is a nice dream, but it's a dream. You'll
| never be allowed to sell a ( _fully_ ) rooted car, just
| like you can't sell a fully-rooted (w baseband) phone. The
| Wild West is over, folks.
|
| If we're very lucky, someone might give root access to a
| (heavily firewalled or air-gapped) media computer.
| > as long as manufacturer doesn't provide a script or
| otherwise encourages you to `kill -9 safetyprocess` or
| something.
|
| Irrelevant. They'll be circulating online within two days.
| If Tesla doesn't stop it, now they're knowingly complicit.
|
| [0]
| https://static.nhtsa.gov/odi/rcl/2022/RCONL-22V235-2686.pdf
| robbyt wrote:
| Citation needed. By this logic no part of a car would be
| legally serviceable by the owner.
| loceng wrote:
| "If an owner cuts their brake light wires to flee the cops"
|
| Is this a tactic that people use to evade police? I can't
| really think of how this would be advantageous.
| dun44 wrote:
| If your safety features could be disabled by root on a non-
| safety critical subsystem, it means your car is already
| unsafe by design.
| 123yawaworht456 wrote:
| 'you vill ovn nothing' went from being a conspiracy theory to
| reality remarkably quickly.
| FirmwareBurner wrote:
| _> Does a Tesla owner have root on their own vehicle_
|
| If they would, they wouldn't have to pay Tesla for the SW
| extras, and just sideload them for free later.
| denysvitali wrote:
| The privilege is kept to the masters at the mothership. As a
| security researcher you can register your car and get an SSH
| certificate (bound to your VIN) to access your car as root.
|
| On top of that, root won't give you _a lot of access_ to the
| car AFAIK. Some specific features are gated under some specific
| operations that require a sequence to unlock the gateway. If
| you also add to the mix the secure boot, it might be hard to do
| persistent harm other than what the infotainment usually does -
| you can't flash the autopilot system nor you can interfere with
| the basic driving functions (?). I'd be happy to be proven
| wrong though.
| Rygian wrote:
| Those are really low EPSS.
| port515 wrote:
| I love the one that opens the charge port door. Use a $350 gadget
| with a chunk of time to set it up, or just rip it open with a
| screwdriver and pop it shut.
| yellow_lead wrote:
| Yep, this is the one that you can exploit using a Flipper Zero.
| Working as intended per Tesla
|
| > * DISPUTED * Certain Tesla vehicles through 2022-03-26 allow
| attackers to open the charging port via a 315 MHz RF signal
| containing a fixed sequence of approximately one hundred
| symbols. NOTE: the vendor's perspective is that the behavior is
| as intended.
| denysvitali wrote:
| To be fair it makes sense that it works as intended: that
| specific frequency is used in home chargers and Superchargers
| to avoid the hassle of opening the charging port via the app
| / the car. The only difference with your own transmitter is
| that you can open the charging port from further away - which
| is just fun as you can eventually use a screwdriver to do the
| same
___________________________________________________________________
(page generated 2023-12-03 23:01 UTC)