Hacker News Reader

Comment by bitmapbrother | Hacker News Reader

The Tesla Android app (there is a new version coming out soon to replace the very dated Android and iOS versions) stores its oauth credentials in plain text in the Tesla app folder. So in order for this to work:

1. User must enable the installation of apps from unknown sources.

2. User must then find and install malicious app.

3. Malicious app must then try and root phone in order to be able to read the oauth credentials stored in the Tesla app folder.

4. And finally, user must own a Tesla.

Chances of this ever happening in the real world: Zero.

View on HN

> Chances of this ever happening in the real world: Zero

I dunno. I've seen more than one person get caught by setting up their phone for development (1), getting suckered into installing some mal-ware laden game (2)... 3 and 4 don't seem _like_ that much of a stretch in the valley.

1. The free burger malware was hosted from Google Play

2. The attack was performed at a restaurant near a Tesla super charger, offering a free Wifi which pushed the Google Play link as ads.

3. The app must not root the phone, but this is pretty straight forward.

4. Pretty likely near a Tesla super charger.

> Chances of this ever happening in the real world: Zero.

We certainly hope so.

We're raising awareness of IoT app security. Read our blog for the original technical details: https://promon.co/blog/

The number of things that must work correctly in your scenario are so unrealistic that I would still say the odds are near zero. If someone wants a Tesla they'll do it the easy way and use a flatbed truck.

The malicious app also needs to be undetected by Google. So it cannot use a root method detected by Play Services apk analyser. It is definitely doable .. but yeah, not really a credible threat at scale.

Or, maybe:

1. The thief saw the target (Tesla owner) have an Android phone

2. The thief somehow arranges to have couple of minutes with target's phone (with some sort of social engineering) and installs necessary software.

Chances of this ever happening in the real world: not zero.

Reply on news.ycombinator.com