Hacker News Reader

Comment by sfifs | Hacker News Reader

> An attacker can read this token if he has access to the user's phone.

> the app will prompt the user to enter his password again, providing the perfect opportunity to collect the user's password. Attackers also modify the Tesla app's source code to steal login data

Come on, if an attacker has access to an unlocked phone there are far more valuable targets than a "connected car" that can possibly be remote disabled any time.

The chain of dependencies outlined in the article is borderline ridiculous.

View on HN

At the end of the day, a username and password is everything you need to drive off with any app enabled Tesla.

You can perform your attack in a number of different ways to achieve this, but setting up a free wifi hotspot near a Tesla super charger allows you to target and harvest several such usernames and passwords with very little effort.

Disclaimer: I work for Promon. Feel free to ask me about the attack.

Well a username and password would let anyone into your primary email account possibly letting them steal your identity and money from your bank account which is again potentially more harmful than stealing a connected car

Are you performing an MITM attack from the WIFI hotspot?

Yes, in our case we did MITM to display ads for a "free burger" app containing malware. The app was hosted on Google Play.

And, you're right. Once we have access to the phone we can probably do a lot worse than just stealing a car.

When it comes to banking apps, they often have mitigations which would require a lot more targeted effort.

If I may, I am a bit perplexed by:

>Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers.

Security by obscurity?

I'm not sure where this quote came from, but I can say that the Tesla app should avoid storing the OAuth token in cleartext.

Disclaimer: I work for Promon. See our blog post: https://promon.co/blog/

The quoted text is the last sentence in the article this thread is about:

http://www.bleepingcomputer.com/news/security/android-malwar...

If the Author of the bleepingcomputer.com article has misunderstood your findings and conclusions and is reporting as yours something you didn't recommend, you should let him know and ask for a correction.

> I can say that the Tesla app should avoid storing the OAuth token in cleartext.

Why? What additional security would encrypting it with a key that's on the same device give you?

A Tesla model S is worth > $50k unless its been in an accident or otherwise damaged. What more valuable thing could someone possibly steal with access to my cell phone?

You can remotely kill someone with a tesla.

Reply on news.ycombinator.com