Exploiting Wi-Fi Stack on Tesla Model S

https://keenlab.tencent.com/en/2020/01/02/exploiting-wifi-stack-on-tesla-model-s/

196 69 7 years ago

keenlab.tencent.com

explorigin• 7 years ago

Technically interesting and also interesting that this comes from Tencent.

Tencent Holdings Limited is a Chinese multinational conglomerate holding company founded in 1998, whose subsidiaries specialise in various Internet-related services and products, entertainment, artificial intelligence and technology both in China and globally.

netsharc• 7 years ago

I'd say it's no different to Google Project Zero.

Of course since it's China, there'd be worries. I'd guess the Chinese government also employs crack hackers, like the NSA probably does?

monocasa4• 7 years ago

Yeah, but they don't share 0 days like this, just like the NSA doesn't.

solarkraft• 7 years ago

Of course since it's China, there'd be worries.

I could imagine the government siphoning off the more valuable exploits.

kccqzy• 7 years ago

If you read the Apple product security announcements you'll find that they (as well as Qihoo 360) has been finding security vulnerabilities in unaffiliated companies' products for a long time. It's not unusual. They probably got the inspiration from Project Zero though.

saagarjha3• 7 years ago

Tencent has a number of security teams in addition to Keen Lab that have been around for a while: Xuanwu for example. I believe Keen Lab itself is some sort of acquisition of Keen Team, which did independent security research.

hwj• 7 years ago

With this "wardriving" gets a whole new meaning ;)

natch2• 7 years ago

The MCU is pretty well decoupled from any driving controls other than helping to display a bit of info like the speedometer. I mean it can even be rebooted anytime while driving. So I suspect the larger effect would be on things like entertainment features. Not really driving. But yes harhar, nice play on words.

AgloeDreams• 7 years ago

Well.. that and GPS and all the worries about logging long term GPS location data, user info and mics and so on. Not a crash risk but could totally be exploited for nasty means. Plus you could falsify data too.

thomaskcr• 7 years ago

There's a CAN bus gateway service listening on a UDP port for commands. MCU can write to CAN in addition to read from it (albeit not all operations).

cjbprime14• 7 years ago

It sounds like you missed that the exploit wasn't in the MCU. That's not the system the wifi chip's connected to.

e2le• 7 years ago

I'm not sure why firefox thinks I need DRM enabled to play the video on there.

Shivetya• 7 years ago

Good to see at end all were reported and acted upon before release.

cjbprime14• 7 years ago

As Linux Kernel 2.6.36 does not support NX

Does the Model S really run 2.6.36, first released ten years ago? I'm sure they're using a stable branch and keeping up with security patches in general [1], but that's still shocking to me.

[1]: although not 100% of security patches are going to end up in the stable@ queue or have their effect on 2.6.36 considered.

stopads3• 7 years ago

There are many 10+ year old linux kernels in embedded devices all over the place, and much less secure systems and services on top of that. It's often called the internet of shitty things.

cjbprime14• 7 years ago

Right, but it's surprising that Tesla would be one of those vendors since they have an ongoing obligation to the security of their devices.

It looks like their open source disclosure of the kernel source is a 4.4 kernel, so something weird is going on there. Maybe they got off 2.6 since the time the vulnerability was discovered?

I see something saying they moved to 4.4 in the 8.1 update in June 2017, which is confusing because it suggests the vulnerability was never live.

But I also see they have multiple CPUs running Linux and don't update the kernel on all of them at the same time, so perhaps the CPU running the 8686 driver wasn't updated?

siffland• 7 years ago

Most car manufacturers are reactive, like the Jeep hack a few years ago. Cyber Security should be on the forefront of their radar, but takes a back seat. So having outdated software is not that big of a surprise. I have a 3 year old phone that functions fine, but i might need to get a new one since it is full of security holes and no updates.

I find myself conflicted since i love the technology behind the new cars, but my paranoia about the lack of security and the inability of myself to do anything about it.

If only they had cameras in the cars so while they are applying the brakes when you are on the interstate they can collect that classic picture of horror on your face....

slg• 7 years ago

It looks like a car would need to be over 2 years behind Tesla's OTA updates for it to still have version 2.6.36 and be vulnerable to this exploit.

https://electrek.co/2017/06/30/tesla-new-linux-kernel-update...

EDIT: See nils2014's comments below. The WiFi chip is connected to the entertainment system which received an updated kernel, but it is seems like the kernel on the WiFi chip itself may not have been updated.

cjbprime14• 7 years ago

(Note that this article is only talking about the dashboard entertainment machine, which probably isn't the one the wifi chip's connected to. Perhaps that one got slower updates.)

nils20143• 7 years ago

The kernel version of the information center is irrelevant.

The Wi-Fi stack is running on a separate module (the Parrot module, as mentioned in the article), which runs its own obsolete linux version.

nils20143• 7 years ago

I'm sure they're using a stable branch and keeping up with security patches

Surely you must be joking... The last kernel 2.6.x LTS version to be maintained is 2.6.32.71, and its maintenance ended in March 2016 [1].

No Security patches were released for 2.6.x since then.

[1] https://en.wikipedia.org/wiki/Linux_kernel_version_history#R...

LinuxBender3• 7 years ago

You are right, but AFAIK they are running CentOS and Redhat have been back-porting security and fixes to major bugs at least until recently. CentOS 6 is in extended support phase 2 [1] Hopefully they move to CentOS 8 soon. I have no idea how this is implemented or if that parrot module has a flashable firmware. It is interesting that they say there is no support for NX. CentOS 6 which is based on the 2.6 kernel does support it. [2] That is not to say that things were compiled with the right options.

[1] https://access.redhat.com/support/policy/updates/errata

[2] https://fedoraproject.or/wiki/Security_Features_Matrix

[ EDIT ] I was advised it is not running CentOS and that may be another system in the vehicle.

castratikron• 7 years ago

So this exploit is not specific to Tesla but rather any Linux 2.6.36 (and maybe up) that uses the 88W8688 (and maybe others), which could be a pretty common combination. And all that's required is an AP running the exploit, everything is automatic. Very impressive.

cjbprime14• 7 years ago

Definitely a common combination. The OLPC XO-1.5 was using this hardware 10+ years ago. It sounds like NX protections defeat the attack, and it looks like they went in soon after this kernel, around 2.6.38.

jandrese2• 7 years ago

To be fair, that is a 10 year old kernel at this point.

jchw• 7 years ago

Q: How come Teslas are running kernels from 2008?

cjbprime14• 7 years ago

It appears that: Tesla bought this all-in-one ARM board from Parrot, and Parrot gave them a 2.6.36 kernel with thousands of custom patches in, and Tesla's not in much of a position to port it to a newer kernel, and then Parrot presumably went on to building other stuff and ignored keeping this kernel up to date and now we're here.

They (probably Parrot) might have updated it in the last year since the vulnerability was discovered though, it's hard to tell.

solotronics• 7 years ago

Would having a Rust based embedded OS help with attacks such as this?

saagarjha3• 7 years ago

Yes, it would panic when the copy reached outside the bounds of the buffer.

jandrese2• 7 years ago

Maybe, but the code in question was released 5 years before Rust was first released.

punnerud2• 7 years ago

By only connecting Tesla to AP with PMF (encrypted management frames) enabled, this exploit would not work? Because then you can not force a reconnect to AP using Deauthenticate frames.

The problem is more explained here in a recent HN post: https://news.ycombinator.com/item?id=21889837

stefan_5• 7 years ago

The DEAUTH thing is entirely incidental to the fully remote kernel code execution exploit chain.

punnerud2• 7 years ago

I can agree on the Deauth, though it would maybe make it less receiptable to automated attack. I see that Action frames also is encrypted and verified when enable PMF, so it is still viable to avoid the exploit?

avisaven• 7 years ago

If you find WiFi-based attacks on devices to be interesting, you may be interested in the following research from Google Project Zero on attacking the iPhone’s WiFi stack (and linked are articles on Android):

https://googleprojectzero.blogspot.com/2017/04/over-air-expl...

AviationAtom• 7 years ago

Was I the only one to notice the scrolling phallus doing things on the the status line for "waiting for Telsa to join our AP" on the article's attached video?

jaimex2• 7 years ago

Patched already but good to know if you're restoring a write off.

Exploiting Wi-Fi Stack on Tesla Model S

Related Stories