Warning after security experts hack Tesla car

http://www.bbc.co.uk/news/technology-33802344

by jgrahamc • 11 years ago

64 56 11 years ago

bbc.co.uk

breser3• 11 years ago

There's a much better article on Wired that goes into more details: http://www.wired.com/2015/08/researchers-hacked-model-s-tesl...

It's also worth noting that Tesla pushed a patch to all of their cars for this yesterday.

ChuckMcM• 11 years ago

Fiat/Chrysler - recalled 1.4M cars, estimate 80+% will get fixed.

Tesla - pushed an OTA update, done.

That pretty much paints the future of "smart software" in cars.

That said, every science fiction book I've ever read where vehicles could be patched over the air, has been been used as a plot device and gone badly for the hero of the story. Interesting times indeed.

bentcorner• 11 years ago

Has there been an incident where an OTA mechanism resulted in something bad? (E.g., MITM attack pushes down evil bits)

It could be argued that the existence of an OTA mechanism incentivizes lower quality (RTM patches); I'd counter that it might do so in the short term only, although I have no data.

chambo6224• 11 years ago

Sounds like Tesla worked with these guys to patch this for all owners before it was disclosed. And they hired Chris Evans from Chrome/Project Zero to lead security. To me those are signals that they take this seriously.

teacup505• 11 years ago

If they took this seriously, they wouldn't have their cars connect to anything, or at the very least, the connected parts would be fully air-gapped.

How is it that we can be repeating the exact same mistakes made in software over the past 40 years, without anyone questioning whether the dangers of cloud-enabling cars is remotely justified by the features provided?

chambo6224• 11 years ago

What makes you think that nobody is questioning it? I'm sure some people are, but the fact that informed consumers are purchasing these cars speaks for itself.

maratd• 11 years ago

anyone questioning whether the dangers of cloud-enabling

So let me get this straight ...

They were able to plug in a laptop into the car and gain control. In fact, physical access is necessary.

Tesla used the cloud connected features to update the software, removing the physical vulnerability.

Yes, the connected nature of the car is an attack vector. But it seems there are other attack vectors which are far worse and the connected nature can be used to protect the vehicle.

vilda• 11 years ago

In first place let's frankly say that interconnecting entertainment system with anything that affects safety is dump idea. They top-notch security professionals should know that.

I was developing entertainment system for Volkswagen's cars a while ago. At the time their cars have several networks interconnected with a simple firewall. They were separated into domains, if I remember correctly it was core (engine, steering wheel), first level (reporting, airbags, etc.), second level (opening windows, etc.), and then entertainment system.

The firewall was one-way. Systems on lower level are able to intercept some messages from higher levels, but are unable to send anything to higher level (with some exception between core and first level). That also means that the entertainment system is unable to open/close windows for example - you have physical buttons for that.

It was a while ago and my memory is rusty. But you get the idea that car systems can be build securely with competent engineers.

varjag• 11 years ago

I'm not sure if it was the case here, but Tesla has an over-the-air update channel, allowing to adjust overall performance envelope including acceleration, braking and suspension via update from the mothership. As long as you allow for that feature, the penetration vector is unavoidable and can't be engineered away.

FireBeyond• 11 years ago

I think it's telling that this is the kind of comment that's voted up.

Jeep remote exploit: "OMG, are you kidding, what kind of idiots would even allow this to be a possibility? Car control systems remotely accessible, etc?"

Tesla: "Kudos to Tesla for taking this seriously and working on it."

mshenfield• 11 years ago

Tesla seems much better prepared to deal with this than most car manufacturers. A downloadable update is a world away from the recall Chrysler had to issue.

joosters2• 11 years ago

True. However, Tesla owners have to accept an 'always on' car, sharing who-know-what with Tesla over its cellular connection. Is there any way to just get OTA updates without giving away personal data (like location) to the company?

angersock2• 11 years ago

How would you know?

EDIT:

I meant that seriously--any functionality which can update the firmware can, by definition, remove your ability to tell that it's doing other things, too. See also "Reflections on Trusting Trust".

EDIT2:

And another downvote. Some people are absurd and clearly don't understand what is a completely reasonable comment about the nature of the security here.

It's not, "How would you (somebody unskilled in these things, snarf snarf, mere mortal compared to angersock) know (anything about this)?".

It's, "How would you (consumer without access to the source code being deployed) know (given that the machine can be made to fake output to whatever is most likely to make you think it's behaving normally)?"

Jesus.

toomuchtodo• 11 years ago

If you want a Tesla, yes, you have to accept that. You don't need to purchase a Tesla though.

As a Model X reservation holder, I am both comfortable and accepting of Tesla having my location data and remote access to my vehicle. I understand that the telematics will allow them to continue to improve the product and future products, and have a better understanding of how their batteries and drivetrains perform in the field. I accept all of the above because they've earned that trust (and would even go further, allowing full access constantly to all autopilot sensor data).

Disclaimer: I am also a smaller Tesla investor. I am biased. I'm willing to make sacrifices for what I consider progress.

x00543• 11 years ago

There isn't at the moment, but I don't see why you couldn't have an update procedure that tells you that you have an OTA update as you start the car and asks you to apply it. For that matter, I do not see why in todays day and age Chrysler can not release an update that customers could just download onto a USB stick, plug the stick into the USB port on the radio, and be done with it.

sp332• 11 years ago

According to the Washington Post, you can opt-out of telematics by calling Tesla. https://www.washingtonpost.com/news/the-switch/wp/2015/06/24... I don't know if this affects updates though.

breser3• 11 years ago

You can opt out but I don't know of anyone that has. Their language suggests you might not get updates, but I think that language is more of a cover every possibility than reality. They always install updates when the vehicle is serviced anyway. So it's not like you're entirely blocked from updates if you do opt out.

From https://www.teslamotors.com/about/legal

    Rights and Choices

    We give you many choices regarding our use and
    disclosure of your personal information. You may opt 
    out at any time and free of charge from:

[snip some irrelvant bits]

    Any processing of personal information for which you 
    have provided your prior explicit opt-in consent by 
    contacting us as indicated in the "How to Contact Us" 
    section below.

    Our collection of Tesla vehicle data. If you no longer 
    wish us to collect Telematics Log Data or any other data 
    from your Tesla vehicle, please contact us as indicated in 
    the "How to Contact Us" section below. Please note
    that, if you opt out from the collection of Telematics Log Data or 
    any other data from your Tesla vehicle, we will not be able
    to notify you of issues applicable to your vehicle in real 
    time, and this may result in your vehicle suffering
    from reduced functionality, serious damage, or inoperability, 
    and it may also disable many features of your vehicle 
    including periodic software and firmware updates, remote 
    services, and interactivity with mobile applications and 
    in-car features such as location search, Internet radio, 
    voice commands, and web browser functionality.

    Our collection of real-time traffic feature data. We 
    only collect this data if the real-time traffic feature is 
    available to you and you elect to use it. If you no longer 
    wish us to collect or share data from your vehicle for this 
    feature, you can stop this collection at any time by simply 
    turning the feature and the data collection off via the 
    "TRAFFIC-BASED ROUTING" setting in Controls > Settings > 
    Apps > Maps & Navigation.

danbruc• 11 years ago

Off-topic - when did sentences and paragraphs become the same thing? I noticed this several times during the last months but may have overlooked it before. Is there something behind that?

dangoor• 11 years ago

I wonder if there's a difference for people writing for TV (this article is on the BBC website) and people writing for "print". It's hard to imagine the NYT publishing an article where each paragraph consists of a single sentence, short of that being the point of the article.

hoopism• 11 years ago

Can we generalize this a bit in light of all the recent car hacks?

"Experts Reveal Connected Devices Are Vulnerable to Hacking"

baseballmerpeak• 11 years ago

Better than Chrysler's approach of making the owner download the patch, copy it on to a blank flash drive, and load it via the in-dash USB.

jakeogh• 11 years ago

Some of us don't want wirelessly connected cars.

jcadam• 11 years ago

This is what you get for buying modern vehicles. Just you try hacking my rusty '86 Pontiac.

... I can't even get the radio to play anything other than a faint static hum.

johnward3• 11 years ago

This required physical access. I'm sure I could do some damage with physical access to any vehicle.

moistgorilla• 11 years ago

For your '86 pontiac it's even easier. All I need to do is cut the brakeline

cmiller12• 11 years ago

I posted about this in another thread about this Tesla "hack", but they required physical access to the INSIDE of the vehicle. An access port in the driver-side footwell.

How is this a security problem? If someone malicious has physical access to a normal car they could cut the brake lines or drain the oil, without even needing to unlock the car.

If I'm inside a car I own I think I'd PREFER it to know I can hack into the car's systems rather than it being totally locked down.

jlg23• 11 years ago

From the wired article:

But they also found that the car’s infotainment system was using an out-of-date browser, which contained a four-year-old Apple WebKit vulnerability that could potentially let an attacker conduct a fully remote hack to start the car or cut the motor. Theoretically, an attacker could make a malicious web page, and if someone in a Tesla car visited the site, could gain access to the infotainment system. “From that point, you’d be able to use a privilege escalation vulnerability to gain additional access and do the other stuff that we described,” Rogers says.

cmiller12• 11 years ago

Theoretically

Well, when they show, in practice, that such an attack is possible, then we can have news headlines about it.

By presenting it like this so Tesla had to patch it to save face, I'm sure they just closed the loophole that would allow consenting car owners to modify their car's software. As a gear-head and life-long tinkerer, I WANT to be able to mess with my car.

boeing_boing• 11 years ago

Needing physical access isn't a limitation here given the browser exploit, but even if it was it is still a security problem.

Cutting the brake lines and draining oil are very obvious methods of sabotage. Two minutes of investigation will make it clear that someone with malicious intent caused an accident.

Malicious code uploaded to a car is hard to detect. The inconveniences, property damage, injuries, deaths and the ability to frame the individual as the cause of those intended consequences are incredibly valuable.

legulere• 11 years ago

The situation with security vulnerabilities in software maybe should be a warning to not use (network-connected) computers to control everything. The internet of everything will probably mean that everything will become hackable.

Warning after security experts hack Tesla car

Related Stories