Model S "Hacked" (again)?

Gizmotoy · Jul 17, 2014

Tesla Model S hack reportedly controls locks, horn, headlights while in motion | Ars Technica

If true, looks like another vulnerability in the API/web access, given the capabilities noted in the article.

qwk · Jul 17, 2014

All of the mentioned commands are accessible through the app, and nothing really noteworthy to access. I would be surprised if someone(not an owner who has a ton of time and access to the CAN bus) actually hacked the car.

Gizmotoy · Jul 17, 2014

qwk said:
All of the mentioned commands are accessible through the app, and nothing really noteworthy to access. I would be surprised if someone(not an owner who has a ton of time and access to the CAN bus) actually hacked the car.

I figured the same, which is why I used "hacked" in the title. There's some kind of vulnerability in Tesla's website/app, again, and probably not the car itself.

yobigd20 · Jul 17, 2014

This whole hack contest and winner is absolutely ridiculous. It sounds like someone came on these forums, found the REST API and library on github, and simply ran the program that was already coded to do exactly that. This is a public facing API. That should *NOT* qualify has a hack and most certainly should *NOT* have won the contest. Now, if somebody was able to unlock their S40 to an S60, or enable supercharging on their S40/S60 via software hack - THAT's a real hack worthy of the prize.

markb1 · Jul 17, 2014

Agree that it's not a real hack. But Tesla probably should restrict these functions when the car is moving, shouldn't it?

skn · Jul 17, 2014

What is the "6-digit" code that the article is referring to?
Qihoo claims security flaw in Tesla Model S software

qwk · Jul 17, 2014

markb1 said:
Agree that it's not a real hack. But Tesla probably should restrict these functions when the car is moving, shouldn't it?

I would be willing to bet that the article is wrong about the "while moving" part. You can't even honk the horn using the app while the car is moving.

markb1 · Jul 17, 2014

skn said:
What is the "6-digit" code that the article is referring to?
Qihoo claims security flaw in Tesla Model S software

I believe this is the previous report being referred to:

http://www.reuters.com/article/2014/03/28/tesla-motors-cybersecurity-idUSL1N0MP1OR20140328

And I think what they mean is that Tesla requires only six characters in your password. I know for a fact they allow passwords that are much longer, though.

skn · Jul 17, 2014

I thought they insisted on at least 8 with upper lower and number in it...

Electroman · Jul 17, 2014

If someone steals my Tesla webapp password, or steals my iPhone with a stored password, and then executes these functions - is that considered a vulnerability in the Model S software ? - just asking

skn · Jul 17, 2014

Well if they don't implement any lockout period after x unsuccessful attempts, don't insist on strong password etc., the system is weak and vulnerable in a strict security sense.

markb1 · Jul 17, 2014

mkjayakumar said:
If someone steals my Tesla webapp password, or steals my iPhone with a stored password, and then executes these functions - is that considered a vulnerability in the Model S software ? - just asking

To wannabe security researchers desperate to make names for themselves, yes.

- - - Updated - - -

skn said:
Well if they don't implement any lockout period after x unsuccessful attempts, don't insist on strong password etc., the system is weak and vulnerable in a strict security sense.

Arguably, such measures are not necessary, because what the password is protecting isn't that important. Of course, with the password, you can unlock the car or exercise controls that could potentially distract the driver, so you may deem security more important because of that.

Canuck · Jul 17, 2014

From my understanding, and please correct me if I am wrong, but when using third party apps, such as Visible Tesla, I think you are giving your password to a third party not associated with Tesla, as well as to anyone who has access to that app's database.

markb1 · Jul 17, 2014

Canuck said:
From my understanding, and please correct me if I am wrong, but when using third party apps, such as Visible Tesla, I think you are giving your password to a third party not associated with Tesla, as well as to anyone who has access to that app's database.

Yes, don't do that.

- - - Updated - - -

Actually, I think Visible Tesla is an app that you run on your own computer, so you don't need to give your password to anybody. I haven't used it. Though you do have to trust the code to handle your password properly, of course, and not secretly send it to some server.

Gizmotoy · Jul 17, 2014

skn said:
I thought they insisted on at least 8 with upper lower and number in it...

I think it used to be 6 until the last time the website/API was hacked, after which they increased the password requirements and implemented an incorrect password lockout mechanism.

Canuck said:
From my understanding, and please correct me if I am wrong, but when using third party apps, such as Visible Tesla, I think you are giving your password to a third party not associated with Tesla, as well as to anyone who has access to that app's database.

Depends on implementation. From my basic understanding, communication via the API actually occurs via something akin to cookies. In Visible Tesla, for example, you enter your password, but Visible Tesla keeps the cookie. It doesn't need to know the password other than as a means for it to get the cookie. Indeed, VT doesn't require you let it save your password. If you do let it, it's stored encrypted, but that's obviously up to the developer, whom you have to trust not to steal your password in either case. Maybe Joe will pop in and clarify.

Pilot_51 · Jul 17, 2014

markb1 said:
Though you do have to trust the code to handle your password properly, of course, and not secretly send it to some server.

VT is open source, so you can check the code yourself if you know how. With the exposure it has received, if there was something malicious going on or a blatant security vulnerability, I'm sure someone in the community would have found it and made everyone else aware if the developer didn't fix it or accept someone else's fix in a timely manner.

aviators99 · Jul 17, 2014

Pilot_51 said:
VT is open source, so you can check the code yourself if you know how. With the exposure it has received, if there was something malicious going on or a blatant security vulnerability, I'm sure someone in the community would have found it and made everyone else aware if the developer didn't fix it or accept someone else's fix in a timely manner.

The API doesn't allow that stuff while the car is moving. I know because (at the request of a friend) I wrote some code to run in the background and honk the horn every time you approach the Tesla statue in Palo Alto. It doesn't work

markb1 · Jul 17, 2014

Pilot_51 said:
VT is open source, so you can check the code yourself if you know how. With the exposure it has received, if there was something malicious going on or a blatant security vulnerability, I'm sure someone in the community would have found it and made everyone else aware if the developer didn't fix it or accept someone else's fix in a timely manner.

I don't mean suggest that VT is doing anything malicious, just that in general, it's something to think about.

skn · Jul 17, 2014

Gizmotoy said:
Depends on implementation. From my basic understanding, communication via the API actually occurs via something akin to cookies. In Visible Tesla, for example, you enter your password, but Visible Tesla keeps the cookie. It doesn't need to know the password other than as a means for it to get the cookie. Indeed, VT doesn't require you let it save your password. If you do let it, it's stored encrypted, but that's obviously up to the developer, whom you have to trust not to steal your password in either case. Maybe Joe will pop in and clarify.

I find it surprising that in this day and age Tesla had to resort to a homegrown insecure way for 3rd party apps to use their APIs. Anyone who has used a Twitter client knows there is a better way to handle such scenarios - OAuth

Only 2 reasons I can think of for Tesla not implementing OAuth:

They think the APIs are not worth such protection: Strange given that it does expose personal location data, could potentially cause nuisance, power of APIs could themselves be beefed up at some point
They never foresaw 3rd party hacks like VT: tsk, tsk....

aviators99 · Jul 17, 2014

skn said:
I find it surprising that in this day and age Tesla had to resort to a homegrown insecure way for 3rd party apps to use their APIs. Anyone who has used a Twitter client knows there is a better way to handle such scenarios - OAuth

Only 2 reasons I can think of for Tesla not implementing OAuth:

They think the APIs are not worth such protection: Strange given that it does expose personal location data, could potentially cause nuisance, power of APIs could themselves be beefed up at some point

They never foresaw 3rd party hacks like VT: tsk, tsk....

I don't find it surprising, because it's completely unnecessary to add any more security than they already have.

Model S "Hacked" (again)?

Active Member

P130DL

Active Member

Well-Known Member

Active Member

Member

P130DL

Active Member

Member

Well-Known Member

Member

Active Member

Well-Known Member

Active Member

Active Member

Member

Model S - R140

Active Member

Member

Model S - R140

Similar threads