All Discussion re: Tesla Motors Website & Forums

[rpo]

And now teslamotors.com is being redirected again. I think Tesla is having issues keeping control of their DNS right now.

 

[stopcrazypp]

Can someone explain to us non-network types (okay, maybe just to me): if the problem is that the DNS servers are redirecting teslamotors.com to a bogus IP address, then why can't we just access the site by typing in the IP address directly?

You can, but no one does that nor do they memorize the IP address.

 

[supratachophobia]

The MyTesla site is being redirected to something starting with "isis.camp" as of right now. That's probably why the mobile app and VisibleTesla are not working.

Yeah @uselesslogin, if you weren't concerned before, you may start your concern now.

 

[thegruf]

getting into the press (inevitably). Look out for some quality and informed reporting coming up ...

http://www.bloomberg.com/news/artic...ed-on-twitter-media-relations-e-mail-accounts

 

[sorka]

The CPO site is also compromised. Since it just went live today and there was big press release about it, you can bet this is doing real damage to Tesla's market place. If I were prospective buyer who hadn't looked until today when the CPO site went live, I'd have serious doubts about this company.

 

[heapmaster]

They could have forged the SSL cert for tesla's site and access the data by just storing all data that is sent to the servers if the tesla app uses the AFNetwork library, see here: Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable to Hackers

 

[CALGARYARSENAL]

LOL. The fear! Talk about a buying opportunity.

 

[jdo]

You can, but no one does that nor do they memorize the IP address.

Understood, but if I type in the IP address right now, it says that Tesla Motors is offline. If the problem is just the DNS server, why would they take the site off-line?

 

[randompersonx]

Also if its just a DNS hack, how does that explain the twitter account hacks? It seems to have been more coordinated.

Taking over the domain would make it easy to reset the twitter password by requesting a password reset link to the relevant teslamotors.com email address.

 

[markwj]

This is a DNS hack. Looks like it has been fixed at the root (control back in Tesla's hands), but the global DNS caches still have the cracker's malicious records.

My recommendations:

1] Don't login to teslamotors.com. Don't login to the remote App. Don't enter any credentials into anything teslamotors.com related.
2] Turn off visible tesla (or anything that could provide your credentials automatically).
3] From what I can see, the crackers went after the main domain, not the vn.teslamotors.com sub-domain, but not entering App credentials still seems prudent at this time.
4] Sit back, relax, and wait for the dust to settle. If you've done #1 and #2, you don't need to worry.

 

[wk057]

The actual website is behind a load balancer/proxy/cache. The proxy is trying to get the DNS for the hidden/internal version of the site (the actual server) and is getting the bad DNS version which doesn't have that host pointed anywhere.

 

[stopcrazypp]

Understood, but if I type in the IP address right now, it says that Tesla Motors is offline. If the problem is just the DNS server, why would they take the site off-line?

Last time I checked a couple hours ago, it was still showing the Tesla site. You are right that it is now showing the site is off for maintenance.

They may have taken it down to make sure the hackers didn't manage to get access to anything. Since the hackers were able to spoof email addresses for quite some time as a recipient (that's likely how they got into the Twitter accounts, by sending a password reset request where the reset link would go to their own server), it's unknown what other accounts they got into.

 

[markwj]

Understood, but if I type in the IP address right now, it says that Tesla Motors is offline. If the problem is just the DNS server, why would they take the site off-line?

Taking it offline is the prudent course of action. It allows them to:

1] Get a forensic snapshot.
2] Make sure that the website itself was not affected, before opening it back up to the public.

 

[supratachophobia]

Taking over the domain would make it easy to reset the twitter password by requesting a password reset link to the relevant teslamotors.com email address.

Bingo, hello new MX records. This is why you should consider extra long TTL's for established DNS records that are unlikely to change.

 

[wk057]

This is a DNS hack. Looks like it has been fixed at the root (control back in Tesla's hands), but the global DNS caches still have the cracker's malicious records.

My recommendations:

1] Don't login to teslamotors.com. Don't login to the remote App. Don't enter any credentials into anything teslamotors.com related.
2] Turn off visible tesla (or anything that could provide your credentials automatically).
3] From what I can see, the crackers went after the main domain, not the vn.teslamotors.com sub-domain, but not entering App credentials still seems prudent at this time.
4] Sit back, relax, and wait for the dust to settle. If you've done #1 and #2, you don't need to worry.

The hackers added a wildcard record for *.teslamotors.com, so they took over all subdomains.

The hackers were not, as of this writing, running an SSL/HTTPS server (port 443) so login attempts wouldn't go anywhere anyway. The hackers shouldn't have a valid cert to pass for teslamotors.com for this anyway, and the app won't connect without a proper cert.

I think the biggest concern of mine is the catch-all email redirect they had in place for mail destined to *@teslamotors.com.

 

[stopcrazypp]

I think the biggest concern of mine is the catch-all email redirect they had in place for mail destined to *@teslamotors.com.

That's the biggest issue I see right now too. There's a lot of stuff they can do with that kind of redirect.

 

[jdo]

Last time I checked a couple hours ago, it was still showing the Tesla site. You are right that it is now showing the site is off for maintenance.

They may have taken it down to make sure the hackers didn't manage to get access to anything. Since the hackers were able to spoof email addresses for quite some time as a recipient (that's likely how they got into the Twitter accounts, by sending a password reset request where the reset link would go to their own server), it's unknown what other accounts they got into.

Taking it offline is the prudent course of action. It allows them to:

1] Get a forensic snapshot.
2] Make sure that the website itself was not affected, before opening it back up to the public.

Makes sense now. Thanks.

 

[gg_got_a_tesla]

In all this, don't know why that poor kid in IL was targeted:

http://www.cnbc.com/id/102620200

It it was wantonly done, hopefully, the link to the perpetrators can quickly be established.

 

[kglad99]

teslamotors.com site and tesla twitter feed problems don't both me.

but my 'visible tesla' app and my iphone model s app are not connecting to my car. is anyone else seeing that?

 

[robapodaca]

I am having issues with my Android app, trying to connect to my car... anyone else having issues? possibly related to the hack?