[HN Gopher] Tesla: Security Vulnerabilities
       ___________________________________________________________________
        
       Tesla: Security Vulnerabilities
        
       Author : nixass
       Score  : 53 points
       Date   : 2023-12-03 16:58 UTC (6 hours ago)
        
 (HTM) web link (www.cvedetails.com)
 (TXT) w3m dump (www.cvedetails.com)
        
       | gleenn wrote:
       | Do we think Tesla looks at these? Looks like at leasthe first
       | handful require code execution privileges initially which is
       | hopefully preventing most of the damage.
        
         | ghewgill wrote:
         | At least two of them are marked as "DISPUTED", so presumably
         | yes, Tesla does respond to them.
        
         | createdapril24 wrote:
         | Tesla not only looks at these, they coordinate their fixes and
         | disclosure. Tesla runs a bug bounty program
         | https://bugcrowd.com/tesla, contracts with security research
         | companies to audit its vehicles, has a security researcher
         | program where they share more access & documentation for
         | researchers who have helped improve vehicle security, and put
         | up both vehicles and cash in pwn2own.
         | 
         | Obtaining code execution, persistence, or privilege escalation
         | on a Tesla is a formidable challenge. Pwn2own went many years
         | without there being any compromise of the vehicle, and last
         | year's compromise was done by a firm that dedicated a lab and
         | team of people for more than 6 months.
        
           | rossjudson wrote:
           | The (ahem) road to this state is probably littered with
           | lessons learned. I'm hopeful that Tesla will share that
           | history, allows its people to write about it, and let the
           | wider community generalize and learn. There's a lot more than
           | cars out there.
        
         | NegativeK wrote:
         | CVEs are the very basics of published security vulnerabilities.
         | Any company that makes software with at least one person who
         | claims to do security will very likely be paying attention to
         | these; Tesla is more than that, so they're going to be doing a
         | lot more.
         | 
         | That said, neither CVSS scores, security researchers, nor
         | security teams are perfect. Some reports will be marked as
         | won't fix, some teams won't publish vulnerabilities as CVEs,
         | and some CVEs will be wildly inaccurate. But yes; they're going
         | to pay attention to them.
        
       | anonporridge wrote:
       | One of the underrated benefits of having hoards of haters, is
       | that they'll work feverishly to find and yell about any and all
       | of your flaws and weakness, for free.
       | 
       | Those who don't have any haters have to pay for that valuable
       | information, and still end up left wondering if the feedback is
       | too soft.
        
         | u320 wrote:
         | What it the evidence that this is what happened here?
        
         | slowhadoken wrote:
         | Yeah it's free QA
        
           | frosting1337 wrote:
           | Nah, they have a bug bounty program, people get paid for
           | their bugs. Probably one of the better things Tesla do is
           | their attitude towards bug hunters.
        
         | demondemidi wrote:
         | "hoard of haters"
         | 
         | If you're not repulsed by Musk, you haven't been paying
         | attention. He is an abhorrent human being, antisemite,
         | conspiracy theorist, anti-human rights, philandering, anti-free
         | speech, billionaire troll. Every one of those claims has
         | citations based in reality. Sorry to burst your bubble.
        
           | alsodumb wrote:
           | I had to read OP's comment again just to make sure I wasn't
           | missing anything - what part of his comment made you go off
           | like this? Burst his bubble? of what?
        
             | __s wrote:
             | I think they read "hoard of haters" like "basket of
             | deplorables"
        
             | ThrowawayTestr wrote:
             | Musk Derangement Syndrome
        
               | qarl wrote:
               | I agree. The similarities between the two are striking.
        
               | ls612 wrote:
               | Texas Man Bad -> Orange Man Bad -> Rocket Man Bad
               | 
               | American culture in the past 20 years in one line.
        
               | qarl wrote:
               | The pattern is pretty obvious, isn't it? You'd think
               | they'd learn.
        
               | ThrowawayTestr wrote:
               | And the ability of their haters to make every discussion
               | about how bad man is bad.
        
               | qarl wrote:
               | Yes. Agreed. It is very obviously very similar.
        
         | mullingitover wrote:
         | I don't know if "Lots of black hats loathe my vehicle's
         | manufacturer and want to do it harm, and potentially by proxy
         | _me_ ," is as beneficial as you're making it out to be.
         | 
         | > they'll work feverishly to find and yell about any and all of
         | your flaws and weakness, for free.
         | 
         | This is a very questionable assumption. I don't see why a black
         | hat who manages to pwn Tesla is going to then turn around and
         | responsibly report the vuln they're using instead of doing
         | maximum damage to the brand, potentially endangering lives of
         | drivers, or selling their 0-day to some other malicious actor.
        
           | taf2 wrote:
           | I'm definitely a Tesla fan.. considering a cyber truck but
           | one concern I have which I think is similar to what your
           | saying is I'm worried because it's been demonstrated as
           | bullet proof what if someone I drive by decides to test it
           | out ?
        
             | idiotsecant wrote:
             | The idea that the cyber truck is 'bylletproof' is
             | laughable. 3mm of stainless sheet does not start defying
             | physics when you sprinkle Tesla marketing on it. Low energy
             | pistol rounds designed for minimal penetration might be
             | stopped but I wouldn't bet your life on it
        
               | kiba wrote:
               | I have seen video of it. It's 'bulletproof' for what they
               | shot at it, which includes handgun, shotgun, and a tommy
               | gun.
               | 
               | I wouldn't rely on it as an armored vehicle. If I want
               | extra protection, then I would spend money on uparmoring
               | it.
        
               | dun44 wrote:
               | Perhaps you shouldn't put so much trust in marketing
               | videos.
               | 
               | https://www.quora.com/How-thick-of-a-hardened-steel-
               | plate-do...
        
               | ponector wrote:
               | Without tests with AR-15 it is simply half-true
               | marketing. but Tesla is full of such statements, like
               | full self driving or price including gas savings.
               | 
               | Toyota should do same marketing tricks with new Prius.
        
               | nickthegreek wrote:
               | They shot the windows?
        
               | pclmulqdq wrote:
               | Depending on the ammunition type, those guns all stand
               | out as having very low penetration.
               | 
               | Starting with the handgun, the two most popular calibers
               | are 9 mm and .45, and if you shoot hollow point rounds,
               | they can even be stopped by a few inches of drywall
               | (hollow points are designed to expand on contact), and
               | lead bullets may also be stopped by the truck if they are
               | shot at an angle, but I wouldn't be sure about high-
               | penetration rounds like full metal jacket. The Tommy gun
               | is also handgun-caliber (assuming they shelled outout a
               | small fortune to rent a real one, .45).
               | 
               | Shotguns have an even wider variety of available
               | projectiles. A shotgun shooting buckshot has far lower
               | kinetic energy behind each projectile than a handgun, and
               | their velocity falls off very quickly with increased
               | range. A slug (a solid chunk of metal) designed for armor
               | penetration, on the other hand, will penetrate 3 mm of
               | steel easily, with similar caveats about range.
        
               | mikeyouse wrote:
               | Especially since those weirdly conceived 'bulletproof'
               | windows went out the window and it's just normal glass so
               | much of the vehicle profile is entirely susceptible to
               | small arms fire.
        
               | haliskerbas wrote:
               | Shhh they don't have a marketing department, there is no
               | marketing!!!! /s
        
             | grecy wrote:
             | > _what if someone I drive by decides to test it out ?_
             | 
             | Where do you live that you actually worry about someone
             | shooting your vehicle while you're out driving?
             | 
             | Wherever it is, you need to leave if that is a valid
             | concern.
        
               | ponector wrote:
               | Sounds like a random US city for me. Are you suggesting
               | to move to Europe?
        
             | mensetmanusman wrote:
             | Tommy gun - nonproblemo
             | 
             | AK47 - accelerate
        
           | neilv wrote:
           | Excellent points. And these hackable vehicles are powerful
           | enough in the physical word to be "kinetic" weapons.
           | 
           | So we should expect the exploit market to include buyers for
           | assassinations (of occupant or person on the street),
           | extortion ("every hour that the Bitcoin aren't transferred,
           | we will take over one of your customer's vehicles in an
           | extremely tragic way, and later we will tell the news media
           | that you declined to prevent it"), economic sabotage, market
           | moving, terrorism, and warfare.
        
             | fiddlerwoaroof wrote:
             | I wonder how bad this is compared to the competition.
             | https://comma.ai allows you to add self-driving features to
             | a large number of non-Tesla cars so, if we're including
             | physical firmware hacks as a threat vector, I'd bet tons of
             | alternative cars (new enough Honda Odysseys, Toyota
             | Siennas, etc: probably anything with adaptive cruise
             | control and lane following) have the same sort of potential
             | vulnerability.
        
               | mullingitover wrote:
               | Probably depends on how online the car is. The always-
               | online, always able to receive manufacturer firmware
               | updates aspect of Teslas is probably the most risky part.
               | I don't worry about anyone hijacking my Civic remotely.
        
               | fiddlerwoaroof wrote:
               | It might be risky in theory, but hasn't firmware signing
               | on Apple Devices and other such devices basically shown
               | that we can do this safely?
        
               | mullingitover wrote:
               | It can be done safely, but if Tesla is compromised and
               | their attackers gain access to their network and their
               | signing keys, all bets are off.
               | 
               | I would bet that there are multiple unfriendly nation
               | states who have intelligence groups persistently looking
               | for ways to penetrate vital networks and secrets, like
               | Tesla's, just to have the option of causing pandemonium
               | if they wish to.
        
         | frosting1337 wrote:
         | Tesla has a decent bug bounty program - the haters get paid.
         | 
         | Source: I'm a paid hater. :)
        
         | hutzlibu wrote:
         | The downside is stronger, if your buisness modell depends on
         | people not knowing your flaws. Like a promised full self
         | driving, that cannot do full self driving, but rather has
         | serious flaws, capable of killing people:
         | 
         | https://arstechnica.com/tech-policy/2023/11/elon-musk-and-te...
        
         | FireBeyond wrote:
         | There's a certain sense of martyrdom around Tesla.
         | 
         | But I think that has nothing to do with this. Tesla has, for
         | better or worse, one of the most "connected" vehicle systems.
         | There are things I don't miss in my car, but I certainly like
         | other things.
         | 
         | That just makes it a bigger target. Attack surface and all
         | that, more opportunities.
         | 
         | It doesn't have to be about "the haters".
        
       | aftbit wrote:
       | Does a Tesla owner have root on their own vehicle, or is that
       | privilege kept for the masters at the mothership?
        
         | schiffern wrote:
         | Selling a car with intentional root access would almost
         | certainly be illegal in the USA, and most places.
         | 
         | Cars have government-mandated safety features, and
         | manufacturers are forbidden from adding kill switches. Selling
         | a car with ( _manufacturer-sanctioned_ ) root access would be
         | legally the same as including a kill switch letting the owner
         | disable safety features.
         | 
         | If an owner cuts their brake light wires to flee the cops, it's
         | 100% on them. If a manufacturer included a switch for it,
         | they'd be in massive trouble.
        
           | mthomasmw wrote:
           | Is there a list of "kill switches encoded in law autos can't
           | make" somewhere?
           | 
           | I know the vehicle data recorder, and I've heard that LTE
           | radios have to report occupancy, though I can't find a
           | requirement that cars need an LTE radio.
           | 
           | There's rumors cars will be mandated to support remote
           | deactivation, but the story is unclear: https://www.usatoday.
           | com/story/news/factcheck/2023/01/19/fac...
           | 
           | relevant: https://consumerwatchdog.org/sites/default/files/20
           | 19-07/KIL...
        
           | drdaeman wrote:
           | It can be argued that root access is not any kind of switch
           | on its own. You have physical access either way - cutting a
           | wire or reprogramming a EEPROM is already a kill switch, root
           | access doesn't add to it, as long as manufacturer doesn't
           | provide a script or otherwise encourages you to `kill -9
           | safetyprocess` or something.
           | 
           | Unless it's mandated by law that there must be anti-
           | circumvention features (components checking system integrity,
           | DRM-like), which root access would actually contradict. But
           | that'd be completely different from prohibition to introduce
           | a kill switch. That'd be a legal requirement that a vehicle
           | or some of its parts mustn't be user-serviceable.
           | 
           | Root access is not a way to break stuff, even though it can
           | be (ab)used as such - it's most certainly not its primary use
           | case. It's a maintenance feature, enabling rightful owner to
           | be able to diagnose, maintain and enhance their own vehicle's
           | software without resorting to hacks. I'm sure that most
           | people would use that to tweak their multimedia console (like
           | adding CarPlay support) or get more diagnostic info about
           | some failure they're facing, not hack their engine control
           | module in some illegal way.
        
             | schiffern wrote:
             | You can argue to NHTSA, sure. You'll lose.
             | 
             | NHTSA forced Tesla to do a recall because the in-car
             | computer let the owner play audio on top of ("obscuring")
             | the pedestrian warning tone.[0] If the in-car computer
             | allowed them _root access_ , they'd have an aneurysm. ;)
             | 
             | A rooted car is a nice dream, but it's a dream. You'll
             | never be allowed to sell a ( _fully_ ) rooted car, just
             | like you can't sell a fully-rooted (w baseband) phone. The
             | Wild West is over, folks.
             | 
             | If we're very lucky, someone might give root access to a
             | (heavily firewalled or air-gapped) media computer.
             | > as long as manufacturer doesn't provide a script or
             | otherwise encourages you to `kill -9 safetyprocess` or
             | something.
             | 
             | Irrelevant. They'll be circulating online within two days.
             | If Tesla doesn't stop it, now they're knowingly complicit.
             | 
             | [0]
             | https://static.nhtsa.gov/odi/rcl/2022/RCONL-22V235-2686.pdf
        
           | robbyt wrote:
           | Citation needed. By this logic no part of a car would be
           | legally serviceable by the owner.
        
           | loceng wrote:
           | "If an owner cuts their brake light wires to flee the cops"
           | 
           | Is this a tactic that people use to evade police? I can't
           | really think of how this would be advantageous.
        
           | dun44 wrote:
           | If your safety features could be disabled by root on a non-
           | safety critical subsystem, it means your car is already
           | unsafe by design.
        
           | 123yawaworht456 wrote:
           | 'you vill ovn nothing' went from being a conspiracy theory to
           | reality remarkably quickly.
        
         | FirmwareBurner wrote:
         | _> Does a Tesla owner have root on their own vehicle_
         | 
         | If they would, they wouldn't have to pay Tesla for the SW
         | extras, and just sideload them for free later.
        
         | denysvitali wrote:
         | The privilege is kept to the masters at the mothership. As a
         | security researcher you can register your car and get an SSH
         | certificate (bound to your VIN) to access your car as root.
         | 
         | On top of that, root won't give you _a lot of access_ to the
         | car AFAIK. Some specific features are gated under some specific
         | operations that require a sequence to unlock the gateway. If
         | you also add to the mix the secure boot, it might be hard to do
         | persistent harm other than what the infotainment usually does -
         | you can't flash the autopilot system nor you can interfere with
         | the basic driving functions (?). I'd be happy to be proven
         | wrong though.
        
       | Rygian wrote:
       | Those are really low EPSS.
        
       | port515 wrote:
       | I love the one that opens the charge port door. Use a $350 gadget
       | with a chunk of time to set it up, or just rip it open with a
       | screwdriver and pop it shut.
        
         | yellow_lead wrote:
         | Yep, this is the one that you can exploit using a Flipper Zero.
         | Working as intended per Tesla
         | 
         | > * DISPUTED * Certain Tesla vehicles through 2022-03-26 allow
         | attackers to open the charging port via a 315 MHz RF signal
         | containing a fixed sequence of approximately one hundred
         | symbols. NOTE: the vendor's perspective is that the behavior is
         | as intended.
        
           | denysvitali wrote:
           | To be fair it makes sense that it works as intended: that
           | specific frequency is used in home chargers and Superchargers
           | to avoid the hassle of opening the charging port via the app
           | / the car. The only difference with your own transmitter is
           | that you can open the charging port from further away - which
           | is just fun as you can eventually use a screwdriver to do the
           | same
        
       ___________________________________________________________________
       (page generated 2023-12-03 23:01 UTC)