janvidar

1. The free burger malware was hosted from Google Play

2. The attack was performed at a restaurant near a Tesla super charger, offering a free Wifi which pushed the Google Play link as ads.

3. The app must not root the phone, but this is pretty straight forward.

4. Pretty likely near a Tesla super charger.

> Chances of this ever happening in the real world: Zero.

We certainly hope so.

We're raising awareness of IoT app security. Read our blog for the original technical details: https://promon.co/blog/

You are right, if the security sandbox is broken, then you have lost control.

But at the same time, you also know that only 0.3% of the Android user base is using this year's version, and less than 25% are using last year's version.

The security design of the app should reflect this.

There are lots of ways to get access to this data, installing an app is a pretty convenient and common way to do so.

Any app can be hacked with enough effort. The Tesla app provided absolutely no resistance, and technically no privilege escalation is required to steal the relevant data. Your screen reader app, or custom keyboard has the relevant access.

>Promon engineers recommend that the Tesla app provide two-factor authentication, should avoid storing the OAuth token in cleartext, prevent easy access to its source code, and use a custom keyboard layout when entering passwords to fight against mobile keyloggers.

We did not recommend this, however the OAuth token should not be in clear text.

I'm not sure where this quote came from, but I can say that the Tesla app should avoid storing the OAuth token in cleartext.

Disclaimer: I work for Promon. See our blog post: https://promon.co/blog/

Yes, in our case we did MITM to display ads for a "free burger" app containing malware. The app was hosted on Google Play.

And, you're right. Once we have access to the phone we can probably do a lot worse than just stealing a car.

When it comes to banking apps, they often have mitigations which would require a lot more targeted effort.

At the end of the day, a username and password is everything you need to drive off with any app enabled Tesla.

You can perform your attack in a number of different ways to achieve this, but setting up a free wifi hotspot near a Tesla super charger allows you to target and harvest several such usernames and passwords with very little effort.

Disclaimer: I work for Promon. Feel free to ask me about the attack.

The OAuth token is also stored in plain text on the device. This is by itself enough to locate, track and unlock the car. The app prompts the user for the username/password in order to start the car.

Mandatory disclaimer: I'm affiliated with Promon.

I don't want Facebook Messenger, and the Facebook app cannot be uninstalled on my device since it came preinstalled with the Android OS on it (HTC One - it can however be disabled).

Now, if someone uses Facebook Messenger to send me a message, my Facebook app will notify me about unread messages - I've disabled most notifications, but the icon still gets a number increase indicating messages that can be read. These messages cannot be read from within the app without installing Messenger. Using the browser no longer work for reading these messages, since they are pushing the Messenger app.

The only sad part here are the few "friends" that actually write their messages to /dev/null trying to reach me...

I've been contemplating disabling my FB account altogether, but it turns out it is required sometimes for authentication. Spotify being an important one for me.

Isn't this really just a sign of flawed hardware design?

In my opinion hardware should be designed so that the camera LED lamp should always be lit if the camera is used. If there is a malfunction with the LED, then the camera should also not work. Also there should be a hardware LED for when the microphone is being used which should work in the same fashion for laptops with built-in microphones.

In the webcam drivers I have looked at the LED is controlled independently of capturing, although drivers do enable the LED when the camera is used. This essentially means that hackers can record and disable the lamp.

I've been considering hacking together some piece of software that will continuously use the camera (/dev/video) in order to block it for other applications, and have it fail with visible alerts if unable to block the camera. Not sure if the same thing can be achieved for the audio recording devices due to multiplexing.

UDP (and TCP) are built on top of IP. You can add other things on top of IP also, but they will be blocked by your average firewall.

I must add Asciidoctor. Which is mostly compatible with Asciidoc, but even more powerful.

I have spent a lot of time trying to make Asciidoc create beautiful PDFs for technical documentation, but Asciidoctor makes it all a lot easier to customize its own stylesheets.

The only negative thing about it is that it is hard to install since it typically isn't found in your distros package repo by default.

These are the EU mandated car safety checks, focusing on breaks, tires, lights, visibility and exhaust.

It is required every 2nd year starting from when the car is 4 years old. Most car manufacturers will do this as part of the standard service interval anyway.

The problem here is that most libraries need to integrate into some sort of main loop somehow, and unfortunately there are lots of different ways of doing the main loop of the application. Some libraries integrate other things which are not directly poll()-able, but expose the same interface while doing so.

Now you have the problem when trying to combine multiple such libraries. For example, you can try using GTK+ and QT in an application at the same time.

One thing that has always bugged me is that there is a lack of standardized (cross platform) non-blocking DNS lookup functionality. This adds to the main-loop complexity, since you have to poll() certain types of resources, and have to deal with threads or subprocessed in order to look for DNS results.

Well written frameworks like Qt abstract away this complexity, but that may not always play nice when mixing libraries.

The average car tax in Norway is on average 102%. Electric cars, and Hydrogen cars have no tax.

The effect is that the Tesla model S cost roughly the same as a BMW 5-series, or Mercedes E-class.

Non-zero-emission cars aren't exactly financially beneficial already. However, long-term they would want to tax ZE cars as well (at least the standard 25% VAT), so hence the fossil cars will need to become even more expensive.

This was precisely addressed by Sir Alexander Fleming's 1945 Nobel Prize speech:

“But I would like to sound one note of warning. Penicillin is to all intents and purposes non-poisonous so there is no need to worry about giving an overdose and poisoning the patient. There may be a danger, though, in underdosage. It is not difficult to make microbes resistant to penicillin in the laboratory by exposing them to concentrations not sufficient to kill them, and the same thing has occasionally happened in the body. The time may come when penicillin can be bought by anyone in the shops. Then there is the danger that the ignorant man may easily underdose himself and by exposing his microbes to non-lethal quantities of the drug make them resistant. Here is a hypothetical illustration. Mr. X. has a sore throat. He buys some penicillin and gives himself, not enough to kill the streptococci but enough to educate them to resist penicillin. He then infects his wife. Mrs. X gets pneumonia and is treated with penicillin. As the streptococci are now resistant to penicillin the treatment fails. Mrs. X dies. Who is primarily responsible for Mrs. X’s death? Why Mr. X whose negligent use of penicillin changed the nature of the microbe. Moral: If you use penicillin, use enough.”

Edit: Fleming's full Nobel lecture: http://www.nobelprize.org/nobel_prizes/medicine/laureates/19...

The problem is that antibiotics is simply too cheap.

The next generations will be a lot more expensive due to the cost of developing it. Sadly, this means that many will die not affording the medicine.

Norway was not affected by WW1 directly, but Hitler occupied Norway during WW2. When the Soviets came to the rescue, the Germans burned down everything as they withdrew from the northern parts.

The most populated areas were largely not affected though.

As for infrastructue, Norway was one of the poorest contries in Europe 100 years ago, with similarly poor infrastructure - so it was not a matter of rebuilding, rather a matter of building.

In this sense oil helped, and foreign oil investments were welcome in the late 60s, but at a 78% tax rate.

I suppose this depends on your machine.

I wish for a developer edition with Ubuntu.

I use client side TLS certificates for several things, but usually not in a browser.

This allows me to check on my server that there is no MITM between the user/device and the server. The user may be inclined to click "OK" and proceed anyway when there is such a warning, but my server will refuse in that case.

Maybe, but in the mean time we have C++.

C doesn't even have strings, but you would typically be using char arrays instead. All you need is a pointer to the array in order to access it. However, if you just have the pointer then you are lacking to essential pieces of information, the length of the string and the capacity of the string.

The length of the string is however by convention determined by the first NULL byte (zero termination), so it is important that there is a NULL byte within the bounds of the allocated array.

Concatenating two "strings", is not particularily difficult, it just needs to be done with care.

If you find it complicated, then you should not use C, nor should you use it for things it's not intended for.

Where did you get that number from?

It is up in the double digits in India.

Well, I suppose you can #define your own?

It is not entirely irrelevant.

Given that there are more developers familiar with HTML development, it may lower the barrier to developing plug-ins, or providing patches.

Really?

I don't remember Windows Mobile having any relevance.

Symbian was pretty much alone at the throne for years before iOS and Android.

Probably doesn't, but it does currently contain a copy of lua, which is written in C.

How about a virtual machine? E.g. kvm, virtualbox, or similar?

Why is it bothersome that the goverment decides that it is illegal for schools to teach a lie?

Schools are a social(ist) institution put in place by the goverment to ensure people have an equal access to knowledge - a foundation. Schools also have to follow a certain curriculum which would give this foundation. A school cannot simply choose to not teach reading or writing, or teach that the earth is flat because they beleive this is the right thing to do.

This has come up previously with different topics over the years. In many countries it is explicitly illegal for schools to teach that the Holocaust ever happened, or use text books that alledge this.

And, this is probably a good thing.