Tesla: Security Vulnerabilities | Hacker News Reader

Tesla: Security Vulnerabilities

cvedetails.com

79 pointsnixass66 comments

Do we think Tesla looks at these? Looks like at leasthe first handful require code execution privileges initially which is hopefully preventing most of the damage.

At least two of them are marked as "DISPUTED", so presumably yes, Tesla does respond to them.

Tesla not only looks at these, they coordinate their fixes and disclosure. Tesla runs a bug bounty program https://bugcrowd.com/tesla, contracts with security research companies to audit its vehicles, has a security researcher program where they share more access & documentation for researchers who have helped improve vehicle security, and put up both vehicles and cash in pwn2own.

Obtaining code execution, persistence, or privilege escalation on a Tesla is a formidable challenge. Pwn2own went many years without there being any compromise of the vehicle, and last year's compromise was done by a firm that dedicated a lab and team of people for more than 6 months.

The (ahem) road to this state is probably littered with lessons learned. I'm hopeful that Tesla will share that history, allows its people to write about it, and let the wider community generalize and learn. There's a lot more than cars out there.

CVEs are the very basics of published security vulnerabilities. Any company that makes software with at least one person who claims to do security will very likely be paying attention to these; Tesla is more than that, so they're going to be doing a lot more.

That said, neither CVSS scores, security researchers, nor security teams are perfect. Some reports will be marked as won't fix, some teams won't publish vulnerabilities as CVEs, and some CVEs will be wildly inaccurate. But yes; they're going to pay attention to them.

Does a Tesla owner have root on their own vehicle, or is that privilege kept for the masters at the mothership?

Selling a car with intentional root access would almost certainly be illegal in the USA, and most places.

Cars have government-mandated safety features, and manufacturers are forbidden from adding kill switches. Selling a car with (manufacturer-sanctioned) root access would be legally the same as including a kill switch letting the owner disable safety features.

If an owner cuts their brake light wires to flee the cops, it's 100% on them. If a manufacturer included a switch for it, they'd be in massive trouble.

Is there a list of "kill switches encoded in law autos can't make" somewhere?

I know the vehicle data recorder, and I've heard that LTE radios have to report occupancy, though I can't find a requirement that cars need an LTE radio.

There's rumors cars will be mandated to support remote deactivation, but the story is unclear: https://www.usatoday.com/story/news/factcheck/2023/01/19/fac...

relevant: https://consumerwatchdog.org/sites/default/files/2019-07/KIL...

It can be argued that root access is not any kind of switch on its own. You have physical access either way - cutting a wire or reprogramming a EEPROM is already a kill switch, root access doesn't add to it, as long as manufacturer doesn't provide a script or otherwise encourages you to `kill -9 safetyprocess` or something.

Unless it's mandated by law that there must be anti-circumvention features (components checking system integrity, DRM-like), which root access would actually contradict. But that'd be completely different from prohibition to introduce a kill switch. That'd be a legal requirement that a vehicle or some of its parts mustn't be user-serviceable.

Root access is not a way to break stuff, even though it can be (ab)used as such - it's most certainly not its primary use case. It's a maintenance feature, enabling rightful owner to be able to diagnose, maintain and enhance their own vehicle's software without resorting to hacks. I'm sure that most people would use that to tweak their multimedia console (like adding CarPlay support) or get more diagnostic info about some failure they're facing, not hack their engine control module in some illegal way.

You can argue to NHTSA, sure. Good luck.

NHTSA forced Tesla to do a recall because the in-car computer allowed the owner to play custom audio on top of ("obscuring") the pedestrian warning tone.[0] If the in-car computer allowed them root access, NHTSA would have an aneurysm.

  > as long as manufacturer doesn't provide a script or otherwise encourages you to `kill -9 safetyprocess` or something.

Doesn't matter.

Scripts will be circulating online within days. If Tesla doesn't stop it, now they're knowingly complicit. Headlines will feature sympathetic low-knowledge users who followed directions, reasoning that it's safe because "why would Tesla let me do it otherwise??" Fin.

A rooted car is a nice dream, but it's just a dream. We'll never be allowed to sell a (fully) rooted car, just like we can't sell a fully-rooted (w baseband) phone. The Wild West is over folks! Last round's on me... :)

If we're very lucky, some manufacturer might give root access to a (heavily firewalled / air-gapped) media computer.

[0] https://static.nhtsa.gov/odi/rcl/2022/RCONL-22V235-2686.pdf

The issue in this particular case was ability to override pedestrian warning system. It is required to emit certain frequencies so (blind/or a pedestrian who is not visually attentive to their surroundings) can hear the vehicle coming (or going) Tesla made it a feature to allow users to mess with this requirement.

However it goes without saying if users could play a tone of their choice in addition to the required noise, no one could have objected to it.

The vehicle effectively became non compliant to one[1] of the fmvss rules

[1]https://www.regulations.gov/document/NHTSA-2016-0125-0001

Citation needed. By this logic no part of a car would be legally serviceable by the owner.

"If an owner cuts their brake light wires to flee the cops"

Is this a tactic that people use to evade police? I can't really think of how this would be advantageous.

Aww, lucky! You're in for a great read.

https://www.wired.com/2007/10/ff-cannonballrun/

I'd read it, but eventually the ads took over the page and I was kicked outside of the paywall

Reader mode on Firefox on the initial page load removed the paywall block for me.

If your safety features could be disabled by root on a non-safety critical subsystem, it means your car is already unsafe by design.

'you vill ovn nothing' went from being a conspiracy theory to reality remarkably quickly.

By this logic we shouldn't be allowed to drive them either, considering that enables a user to commit murder if not mass murder

...although I expect that to actually be a law once self driving is figured out and widespread

Driving is a necessary feature of a car, having a switch to turn off the brake light function isn't. You sure it's logic that you are applying?

>Does a Tesla owner have root on their own vehicle

If they would, they wouldn't have to pay Tesla for the SW extras, and just sideload them for free later.

The privilege is kept to the masters at the mothership. As a security researcher you can register your car and get an SSH certificate (bound to your VIN) to access your car as root.

On top of that, root won't give you _a lot of access_ to the car AFAIK. Some specific features are gated under some specific operations that require a sequence to unlock the gateway. If you also add to the mix the secure boot, it might be hard to do persistent harm other than what the infotainment usually does - you can't flash the autopilot system nor you can interfere with the basic driving functions (?). I'd be happy to be proven wrong though.

I love the one that opens the charge port door. Use a $350 gadget with a chunk of time to set it up, or just rip it open with a screwdriver and pop it shut.

Yep, this is the one that you can exploit using a Flipper Zero. Working as intended per Tesla

> * DISPUTED * Certain Tesla vehicles through 2022-03-26 allow attackers to open the charging port via a 315 MHz RF signal containing a fixed sequence of approximately one hundred symbols. NOTE: the vendor's perspective is that the behavior is as intended.

To be fair it makes sense that it works as intended: that specific frequency is used in home chargers and Superchargers to avoid the hassle of opening the charging port via the app / the car. The only difference with your own transmitter is that you can open the charging port from further away - which is just fun as you can eventually use a screwdriver to do the same

Wonder why the other vendors are listed as having none.

HackerOne says there have been hundreds reported and most car vendors can't OTA patch.

One of the underrated benefits of having hoards of haters, is that they'll work feverishly to find and yell about any and all of your flaws and weakness, for free.

Those who don't have any haters have to pay for that valuable information, and still end up left wondering if the feedback is too soft.

What it the evidence that this is what happened here?

Yeah it’s free QA

Nah, they have a bug bounty program, people get paid for their bugs. Probably one of the better things Tesla do is their attitude towards bug hunters.

"hoard of haters"

If you're not repulsed by Musk, you haven't been paying attention. He is an abhorrent human being, antisemite, conspiracy theorist, anti-human rights, philandering, anti-free speech, billionaire troll. Every one of those claims has citations based in reality. Sorry to burst your bubble.

I had to read OP's comment again just to make sure I wasn't missing anything - what part of his comment made you go off like this? Burst his bubble? of what?

I think they read "hoard of haters" like "basket of deplorables"

I don't know if "Lots of black hats loathe my vehicle's manufacturer and want to do it harm, and potentially by proxy me," is as beneficial as you're making it out to be.

> they'll work feverishly to find and yell about any and all of your flaws and weakness, for free.

This is a very questionable assumption. I don't see why a black hat who manages to pwn Tesla is going to then turn around and responsibly report the vuln they're using instead of doing maximum damage to the brand, potentially endangering lives of drivers, or selling their 0-day to some other malicious actor.

I’m definitely a Tesla fan.. considering a cyber truck but one concern I have which I think is similar to what your saying is I’m worried because it’s been demonstrated as bullet proof what if someone I drive by decides to test it out ?

The idea that the cyber truck is 'bylletproof' is laughable. 3mm of stainless sheet does not start defying physics when you sprinkle Tesla marketing on it. Low energy pistol rounds designed for minimal penetration might be stopped but I wouldn't bet your life on it

I have seen video of it. It's 'bulletproof' for what they shot at it, which includes handgun, shotgun, and a tommy gun.

I wouldn't rely on it as an armored vehicle. If I want extra protection, then I would spend money on uparmoring it.

Perhaps you shouldn’t put so much trust in marketing videos.

https://www.quora.com/How-thick-of-a-hardened-steel-plate-do...

Without tests with AR-15 it is simply half-true marketing. but Tesla is full of such statements, like full self driving or price including gas savings.

Toyota should do same marketing tricks with new Prius.

They shot the windows?

Depending on the ammunition type, those guns all stand out as having very low penetration.

Starting with the handgun, the two most popular calibers are 9 mm and .45, and if you shoot hollow point rounds, they can even be stopped by a few inches of drywall (hollow points are designed to expand on contact), and lead bullets may also be stopped by the truck if they are shot at an angle, but I wouldn't be sure about high-penetration rounds like full metal jacket. The Tommy gun is also handgun-caliber (assuming they shelled outout a small fortune to rent a real one, .45).

Shotguns have an even wider variety of available projectiles. A shotgun shooting buckshot has far lower kinetic energy behind each projectile than a handgun, and their velocity falls off very quickly with increased range. A slug (a solid chunk of metal) designed for armor penetration, on the other hand, will penetrate 3 mm of steel easily, with similar caveats about range.

Just replying to myself because I watched the video: the Tommy gun was loaded with hollow points, the pistol was a 9 mm Glock and shooting regular lead bullets and one of them penetrated, and the shotgun was 00 buckshot, and even the buckshot had a penetration. Their excuse for both penetrations was "two hit right in the same spot," but that is pretty doubtful. They also used a suppressed MP5 in the mix, which would have lower velocity (and thus less penetration) than the pistol, and shot the same ammunition as the pistol. All in all, a very unimpressive trial.

Suppressors don’t have a significant effect on muzzle velocity [0]. That said, in my experience, most people who shoot suppressed intentionally shoot subsonic rounds, since they are inherently quieter.

If anyone in Arizona gets a Cybertruck and is interested in more testing, I own a (legal) machine gun and I would be honored to test your vehicle’s bulletproofing. I’ll even supply the ammo.

[0] https://arxiv.org/pdf/1802.05748.pdf

> and a tommy gun

Al Capone hates this one weird trick.

Especially since those weirdly conceived 'bulletproof' windows went out the window and it's just normal glass so much of the vehicle profile is entirely susceptible to small arms fire.

Shhh they don’t have a marketing department, there is no marketing!!!! /s

> what if someone I drive by decides to test it out ?

Where do you live that you actually worry about someone shooting your vehicle while you're out driving?

Wherever it is, you need to leave if that is a valid concern.

Sounds like a random US city for me. Are you suggesting to move to Europe?

Tommy gun - nonproblemo

AK47 - accelerate

Indeed - a bit like how police riot shields seem to attract people to throw stones, I did wonder whether Elon's antics might encourage people to pelt any cybertruck they see with bricks, just to see.

Excellent points. And these hackable vehicles are powerful enough in the physical word to be "kinetic" weapons.

So we should expect the exploit market to include buyers for assassinations (of occupant or person on the street), extortion ("every hour that the Bitcoin aren't transferred, we will take over one of your customer's vehicles in an extremely tragic way, and later we will tell the news media that you declined to prevent it"), economic sabotage, market moving, terrorism, and warfare.

I wonder how bad this is compared to the competition. https://comma.ai allows you to add self-driving features to a large number of non-Tesla cars so, if we’re including physical firmware hacks as a threat vector, I’d bet tons of alternative cars (new enough Honda Odysseys, Toyota Siennas, etc: probably anything with adaptive cruise control and lane following) have the same sort of potential vulnerability.

Probably depends on how online the car is. The always-online, always able to receive manufacturer firmware updates aspect of Teslas is probably the most risky part. I don't worry about anyone hijacking my Civic remotely.

It might be risky in theory, but hasn’t firmware signing on Apple Devices and other such devices basically shown that we can do this safely?

It can be done safely, but if Tesla is compromised and their attackers gain access to their network and their signing keys, all bets are off.

I would bet that there are multiple unfriendly nation states who have intelligence groups persistently looking for ways to penetrate vital networks and secrets, like Tesla's, just to have the option of causing pandemonium if they wish to.

at some point the exploit does becomes known, but with the reporting (read: tracking) available on Teslas, I'd be surprised if an exploit being exploited isn't discovered sooner, rather than later. After reports of them being stolen get escalated by the police, how they're getting stolen or getting into unexplained accidents will be investigated. It's not like there's a keyhole to jam a screwdriver and an iphone cable in to steal the things.

and the ability for Tesla to update the firmware remotely means they don't have to do a recall in order to fix an issue.

Tesla has a decent bug bounty program - the haters get paid.

Source: I'm a paid hater. :)

The downside is stronger, if your buisness modell depends on people not knowing your flaws. Like a promised full self driving, that cannot do full self driving, but rather has serious flaws, capable of killing people:

https://arstechnica.com/tech-policy/2023/11/elon-musk-and-te...

There's a certain sense of martyrdom around Tesla.

But I think that has nothing to do with this. Tesla has, for better or worse, one of the most "connected" vehicle systems. There are things I don't miss in my car, but I certainly like other things.

That just makes it a bigger target. Attack surface and all that, more opportunities.

It doesn't have to be about "the haters".

Physical access = game over?

Those are really low EPSS.

Reply on news.ycombinator.com