iPhone app login credentials and a big security hole?

HankLloydRight · May 17, 2015

I recently posted about my charge port door opening overnight here: Phantom charge port door opening?

Now also my rear hatch has opened up by itself once over night, and I'm sure I'm not hitting the remote.

So I think someone might have my Mytesla login credentials and is hacking their way around my car.

So I just went to the my.teslamotors.com website and changed my password.

But my iPhone and iPad apps are still connected to my car!

I'm stunned that these apps do not re-authenticate themselves at least every time the app is opened up. I even did a "force quit" on them and they still open up connected to, and controlling my car with no re-login authentication.

Now if someone does have my OLD credentials, they can still happily go along and control my car. This seems like a really strange oversight to me.

mibaro2 · May 17, 2015

That is strange.

When I changed mytesla password, I had to enter my new password in the app. I think the message was Failed To Connect.

markwj · May 17, 2015

Technically, when you authenticate with the App you are given a token and that token is used for future authentication until it expires (or is deleted on the server).

Tesla should be deleting all tokens if you change your password on My Tesla. I've heard this reported before (in the API threads somewhere), and your report sounds like they still aren't doing it.

Rockster · May 17, 2015

I changed my login credentials after Tesla's April 26th server issue and my phone still hasn't asked me to reauthenticate.

HankLloydRight · May 17, 2015

That's not good. Wow.

Zythryn · May 17, 2015

Wouldn't it be simpler to turn off remote access and see if the odd behavior continues?

HankLloydRight · May 17, 2015

Zythryn said:
Wouldn't it be simpler to turn off remote access and see if the odd behavior continues?

Good idea, I'll try that. Thanks.

Obsoletion · May 17, 2015

HankLloydRight said:
Now also my rear hatch has opened up by itself once over night, and I'm sure I'm not hitting the remote.

Can that be opened from the app?

markwj · May 17, 2015

I remember now where I first read about this. Back in 2013, George Reese's 'the API is flawed' blog:

Authentication Flaws in the Tesla Model S REST API - O'Reilly Broadcast

I really hate to bring it back up here, given that George and I disagree philosophically on the possible existence of private APIs, but he has some insight into this.

In his original post he wrote:

No mechanism exists for revoking the access of a compromised application (major)

In a later revision (based on community feedback), he retracted that and put:

-> attacker gains access to a web site's database of authenticated tokens. It has free access to all of that site's cars up to 3 months unless the user changes their TeslaMotors.com password, in which case access for all third-party applications is revoked give or take some unspecified caching interval.

So, seems that at that time, changing the my tesla password resolved this, but that was subject to some unspecified caching interval.

AllenWong · May 17, 2015

Obsoletion said:
Can that be opened from the app?

I can answer this question since I played around with the API extensively for the past month. The answer is no, not even a 3rd party app like VisibleTesla can do it. I suspect something else is going on.

RAW84 · May 18, 2015

I agree this is a significant hole. I have confirmed that changing my password did not prevent my Android app from connecting.

Trustno1 · May 18, 2015

I expirienced something similar when I sold my old P85.

I had access to the car through VisibleTesla several weeks after it was removed from my tesla account.

RAW84 · May 25, 2015

RAW84 said:
I agree this is a significant hole. I have confirmed that changing my password did not prevent my Android app from connecting.

It looks like they fixed this. It promoted me for a password this morning, finally. I then changed my password again, and it promoted me for a password when I tried the app an hour later.

This is for the Android app, btw, tho I bet it is the same for iOS

HankLloydRight · May 25, 2015

RAW84 said:
It looks like they fixed this. It promoted me for a password this morning, finally. I then changed my password again, and it promoted me for a password when I tried the app an hour later.

This is for the Android app, btw, tho I bet it is the same for iOS

Yes, I've been meaning to post an update to this thread.

After I posted this thread, I was contacted by a Tesla engineer who was working to fix the issue, which he told me they did. It did require expiring a lot of tokens that day, so a lot of people may have had to re-login as a result, but they did tell me the issue that I had has been fixed. They also told me that they hope to offer more control over auth tokens and device access in the future.

thecloud · May 25, 2015

HankLloydRight said:
Yes, I've been meaning to post an update to this thread.

After I posted this thread, I was contacted by a Tesla engineer who was working to fix the issue, which he told me they did. It did require expiring a lot of tokens that day, so a lot of people may have had to re-login as a result, but they did tell me the issue that I had has been fixed. They also told me that they hope to offer more control over auth tokens and device access in the future.

Interesting! I noticed a few days ago that I had to log in unexpectedly when I was checking my charging status. Guess this explains it.

AnOutsider · May 25, 2015

HankLloydRight said:
Yes, I've been meaning to post an update to this thread.

After I posted this thread, I was contacted by a Tesla engineer who was working to fix the issue, which he told me they did. It did require expiring a lot of tokens that day, so a lot of people may have had to re-login as a result, but they did tell me the issue that I had has been fixed. They also told me that they hope to offer more control over auth tokens and device access in the future.

Good to know they're on it. Perhaps with the "hacker princess" gone, Tesla should get a new security team in place to do pen tests and such on a regular basis (if they don't already)

Search

iPhone app login credentials and a big security hole?

HankLloydRight

No Roads

mibaro2

Member

markwj

Asia Pacific

Rockster

Active Member

HankLloydRight

No Roads

Zythryn

Custom Warming Stripes wrap.

HankLloydRight

No Roads

Obsoletion

Member

markwj

Asia Pacific

AllenWong

Member

RAW84

Member

Trustno1

Member

RAW84

Member

HankLloydRight

No Roads

thecloud

As rhythm raced inside, the ship came alive

AnOutsider

S532 # XS27

Similar threads