Hacker News Reader

Comment by bluesign | Hacker News Reader

I hate when people use some brands publicity to promote themselves.

Tesla clearly has no fault here.

so basically:

- you need to download an malicious app - your phone has to have some security bug to bypass 'sandbox' via some root privilidges

I can understand if you blame google for android, or user for downloading app. But after this chain, there is virtually no app you cannot hack.

>Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers.

btw none of these suggestions preventing anything if you have the conditions above, suggests me they have no idea what they are talking about

View on HN

"Almost" doesn't count for security. Android is a known insecure platform, don't allow things running on the platform to open people's cars.

> Android is a known insecure platform

And so is iOS, macOS, Windows, Linux, etc. if by insecure you mean "has has historically had security holes and can be used in an insecure manner".

If you mean that Android is just "insecure" as a general statement, though, I'd have to disagree. The operating system itself can be used in a moderately secure way is relation to other popular mobile OS's like iOS.

There are lots of ways to get access to this data, installing an app is a pretty convenient and common way to do so.

Any app can be hacked with enough effort. The Tesla app provided absolutely no resistance, and technically no privilege escalation is required to steal the relevant data. Your screen reader app, or custom keyboard has the relevant access.

We did not recommend this, however the OAuth token should not be in clear text.

you know that storing OAuth token in anyway (encrypted etc) doesnt change anything right?

for screen readers and custom keyboards, thats why OS warns you with a really scary notice, that keyboard can read your passwords.

I dont think you can read OAuth token without priviledge escalation btw.

> however the OAuth token should not be in clear text.

How would you suggest to store it in a way that prevents someone with root access to the phone from reading it? Any encryption keys stored by the application would surely be just as easily readable by root, right?

This blog post does contain those recommendations:

https://promon.co/blog/tesla-cars-can-be-stolen-by-hacking-t...

Near the bottom, it says:

The app should provide its own keyboard for entering the username and password. Otherwise, malicious third party keyboards can act as keyloggers to obtain the user’s credentials.

And:

The app should be protected against reverse engineering.

> The app should provide its own keyboard for entering the username and password. Otherwise, malicious third party keyboards can act as keyloggers to obtain the user’s credentials.

This doesn't really help, if the attacker already has root on the device they can simply hook the login or key entry function in the application. They can also just screenshot on tap when the app is launched (though that's the lame way).

> The app should be protected against reverse engineering.

There's no such thing, I hate when people say things like this. If you rely on protections against reverse engineering, you rely on half-measures.

A determined reverser will always break your app. It might take minutes or days, but it'll always happen and they only need to break it once for it to be broken for everyone.

Ultimately this is a phone security issue. Don't download and run untrustworthy code, doubly so if your ROM is out of date and vulnerable.

As the immutable law of security says: If someone has root on your device, it's not your device anymore!

if the attacker has root on the device, he can do absolutely everything he wants with it. I don't think any app can do anything at that point.

>and use a custom keyboard layout when entering passwords to fight against mobile keyloggers.

mobile keylogger ?

is that a thing ?

AFAIK, the only way to access keyboard input on Android is to be the Active keyboard. Now that I think about it, maybe that accessibility services can too (not sure about that one).

Both need the approval of the user. I have no doubt that some users click yes without reading the warnings though.

Do other car companies allow cars to be controlled via an Android app? Some people might see that as a feature, but to me that seems like a pretty bad product decision precisely because Android is so vulnerable.

if you mean by control, unlock, tracking etc, I am sure BMW supports.

Yes, most major companies support mobile start with both ios and android apps.

Reply on news.ycombinator.com