Hacker News Reader

Comment by mullingitover | Hacker News Reader

I don't know if "Lots of black hats loathe my vehicle's manufacturer and want to do it harm, and potentially by proxy me," is as beneficial as you're making it out to be.

> they'll work feverishly to find and yell about any and all of your flaws and weakness, for free.

This is a very questionable assumption. I don't see why a black hat who manages to pwn Tesla is going to then turn around and responsibly report the vuln they're using instead of doing maximum damage to the brand, potentially endangering lives of drivers, or selling their 0-day to some other malicious actor.

View on HN

Excellent points. And these hackable vehicles are powerful enough in the physical word to be "kinetic" weapons.

So we should expect the exploit market to include buyers for assassinations (of occupant or person on the street), extortion ("every hour that the Bitcoin aren't transferred, we will take over one of your customer's vehicles in an extremely tragic way, and later we will tell the news media that you declined to prevent it"), economic sabotage, market moving, terrorism, and warfare.

I wonder how bad this is compared to the competition. https://comma.ai allows you to add self-driving features to a large number of non-Tesla cars so, if we’re including physical firmware hacks as a threat vector, I’d bet tons of alternative cars (new enough Honda Odysseys, Toyota Siennas, etc: probably anything with adaptive cruise control and lane following) have the same sort of potential vulnerability.

Probably depends on how online the car is. The always-online, always able to receive manufacturer firmware updates aspect of Teslas is probably the most risky part. I don't worry about anyone hijacking my Civic remotely.

It might be risky in theory, but hasn’t firmware signing on Apple Devices and other such devices basically shown that we can do this safely?

It can be done safely, but if Tesla is compromised and their attackers gain access to their network and their signing keys, all bets are off.

I would bet that there are multiple unfriendly nation states who have intelligence groups persistently looking for ways to penetrate vital networks and secrets, like Tesla's, just to have the option of causing pandemonium if they wish to.

I’m definitely a Tesla fan.. considering a cyber truck but one concern I have which I think is similar to what your saying is I’m worried because it’s been demonstrated as bullet proof what if someone I drive by decides to test it out ?

> what if someone I drive by decides to test it out ?

Where do you live that you actually worry about someone shooting your vehicle while you're out driving?

Wherever it is, you need to leave if that is a valid concern.

Sounds like a random US city for me. Are you suggesting to move to Europe?

Indeed - a bit like how police riot shields seem to attract people to throw stones, I did wonder whether Elon's antics might encourage people to pelt any cybertruck they see with bricks, just to see.

The idea that the cyber truck is 'bylletproof' is laughable. 3mm of stainless sheet does not start defying physics when you sprinkle Tesla marketing on it. Low energy pistol rounds designed for minimal penetration might be stopped but I wouldn't bet your life on it

Especially since those weirdly conceived 'bulletproof' windows went out the window and it's just normal glass so much of the vehicle profile is entirely susceptible to small arms fire.

I have seen video of it. It's 'bulletproof' for what they shot at it, which includes handgun, shotgun, and a tommy gun.

I wouldn't rely on it as an armored vehicle. If I want extra protection, then I would spend money on uparmoring it.

Depending on the ammunition type, those guns all stand out as having very low penetration.

Starting with the handgun, the two most popular calibers are 9 mm and .45, and if you shoot hollow point rounds, they can even be stopped by a few inches of drywall (hollow points are designed to expand on contact), and lead bullets may also be stopped by the truck if they are shot at an angle, but I wouldn't be sure about high-penetration rounds like full metal jacket. The Tommy gun is also handgun-caliber (assuming they shelled outout a small fortune to rent a real one, .45).

Shotguns have an even wider variety of available projectiles. A shotgun shooting buckshot has far lower kinetic energy behind each projectile than a handgun, and their velocity falls off very quickly with increased range. A slug (a solid chunk of metal) designed for armor penetration, on the other hand, will penetrate 3 mm of steel easily, with similar caveats about range.

Just replying to myself because I watched the video: the Tommy gun was loaded with hollow points, the pistol was a 9 mm Glock and shooting regular lead bullets and one of them penetrated, and the shotgun was 00 buckshot, and even the buckshot had a penetration. Their excuse for both penetrations was "two hit right in the same spot," but that is pretty doubtful. They also used a suppressed MP5 in the mix, which would have lower velocity (and thus less penetration) than the pistol, and shot the same ammunition as the pistol. All in all, a very unimpressive trial.

Suppressors don’t have a significant effect on muzzle velocity [0]. That said, in my experience, most people who shoot suppressed intentionally shoot subsonic rounds, since they are inherently quieter.

If anyone in Arizona gets a Cybertruck and is interested in more testing, I own a (legal) machine gun and I would be honored to test your vehicle’s bulletproofing. I’ll even supply the ammo.

[0] https://arxiv.org/pdf/1802.05748.pdf

Without tests with AR-15 it is simply half-true marketing. but Tesla is full of such statements, like full self driving or price including gas savings.

Toyota should do same marketing tricks with new Prius.

Perhaps you shouldn’t put so much trust in marketing videos.

https://www.quora.com/How-thick-of-a-hardened-steel-plate-do...

> and a tommy gun

Al Capone hates this one weird trick.

They shot the windows?

Shhh they don’t have a marketing department, there is no marketing!!!! /s

Tommy gun - nonproblemo

AK47 - accelerate

at some point the exploit does becomes known, but with the reporting (read: tracking) available on Teslas, I'd be surprised if an exploit being exploited isn't discovered sooner, rather than later. After reports of them being stolen get escalated by the police, how they're getting stolen or getting into unexplained accidents will be investigated. It's not like there's a keyhole to jam a screwdriver and an iphone cable in to steal the things.

and the ability for Tesla to update the firmware remotely means they don't have to do a recall in order to fix an issue.

Reply on news.ycombinator.com