Hackers Able To Control Tesla S Systems From Twelve Miles Away
from the welcome-to-the-new-normal dept
Over the last few years, we've well documented the abysmal security in the internet of things space. And while refrigerators that leak your Gmail credentials are certainly problematic, the rise in exploitable vehicle network security is exponentially more worrying. Reports emerge almost monthly detailing how easy it is for hackers to bypass vehicle security, allowing them to at best fiddle with in-car systems like air conditioning, and at worst take total control of a compromised vehicle. It's particularly problematic given these exploits may take years to identify and patch.Enter Tesla, which, while indisputably more flexible in terms of technology, finds itself no less vulnerable to being embarrassed. Reports this week emerged that Chinese white hat hackers discovered a vulnerability in the Tesla S series that allowed an intruder to interfere with the car’s brakes, door locks, dashboard computer screen and other electronically controlled systems in the vehicle. In a video, the hackers demonstrated how they were able to target the vehicle's controller area network, or CAN bus, from up to twelve miles away:Fortunately in this instance, the attack required a fairly strict set of circumstances, including fooling the car's owner into first connecting the vehicle to a malicious hotspot -- while the car's internet browser was in use. Also, unlike some vulnerabilities, which have taken traditional automakers up to five years to patch in the past, the researchers said in a blog post that Tesla was quick to update the car's firmware and fix the vulnerability:
"Keen Security Lab appreciates the proactive attitude and efforts of Tesla Security Team, leading by Chris Evans, on responding our vulnerability report and taking actions to fix the issues efficiently. Keen Security Lab is coordinating with Tesla on issue fixing to ensure the driving safety of Tesla users."That said, this isn't the first time that hackers have highlighted vulnerabilities in Tesla vehicles. A group of hackers earlier this year demonstrated how they were able to use about $100,000 in radio equipment to fool the Tesla S model's autopilot feature into perceiving obstacles that technically didn't exist, or obscuring obstacles the car would normally avoid:
"A group of researchers at the University of South Carolina, China’s Zhejiang University and the Chinese security firm Qihoo 360 says it’s done just that. In a series of tests they plan to detail in a talk later this week at the Defcon hacker conference, they found that they could use off-the-shelf radio-, sound- and light-emitting tools to deceive Tesla’s autopilot sensors, in some cases causing the car’s computers to perceive an object where none existed, and in others to miss a real object in the Tesla’s path."Comforting! Obviously these are just the vulnerabilities we know of, and there's likely a very hot zero day market for car vulnerabilities, with state actors willing to pay top dollar for exploits allowing the staging of "accidents" local yokel investigators aren't likely to ferret out as malicious. Alongside the even worse security in many "smart" (read: wholly idiotic) internet of things appliances, we've been happily introducing tens of thousands of new network attack vectors annually. As we rush unpatched toward the driverless future of tomorrow, what could possibly go wrong?
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: connected cars, hackability, iot
Companies: tesla
Reader Comments
The First Word
“Hey there Elmer!
So, a browser exploit was immediately patched? Because all the cars are Internet connected? This is exactly how it's supposed to work. That's the benefit to having devices connected; which you constantly poop FUD on. Programs will have bugs, computers will have exploits. That shouldn't keep us from using them and fixing them when necessary.Subscribe: RSS
View by: Time | Thread
For those of us who value our privacy, there is no need of it.
But for those who would give away their privacy in exchange of a shred of security, to make that clear that not only they won't get that extra bit of security.
But that they will be way less secure than without encrypted and protected systems.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
Lest its control system be turned into someone else's entertainment system.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
It's almost like Tesla understands that they were just helped.
[ link to this | view in chronology ]
Breaking the autopilot.
[ link to this | view in chronology ]
surprised?
Man is not perfect
there's always a loop hole if man is involved
repeat
[ link to this | view in chronology ]
If they were smarter, they'd disable internet access to their cars... but that would be an inconvenience, and convenience trumps security Every Freaking Time.
[ link to this | view in chronology ]
Re:
source: Work in IT. Security is only a problem if you get fucking hacked, or you can show and article of someone else being hacked in that way. If someone else is NOT hacked in that exact way then it is non-sequitur.
Idea's like JEA or Security Risk Mitigation are just fucking lost on management. Entire teams would bitch about losing access to a system they never touch except during build/decom processes and that is just fucking SOP.
No one accepts the idea that they should just not fucking have access until they NEED IT!
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
The computer is your friend,
And sure. Sure, you'll get those 4 years back, Logan...
And yeah, I'll get right on that, Dave.
[ link to this | view in chronology ]
Hey there Elmer!
[ link to this | view in chronology ]
Re: Hey there Elmer!
Or the government serves a warrant to wiretap the on-board mics. Internet-connected cars face the same problems of other cloud services.
[ link to this | view in chronology ]
Re: Re: Hey there Elmer!
Companies and developers should be cautious and thorough with features, but if you don't think there's any way to ever implement them, let me show you to the horse and buggy store.
[ link to this | view in chronology ]
Re: Re: Re: Hey there Elmer!
Should be, but they will not. Profits are the highest priority (only priority for some) while the should have things are shelved based upon how much the corp might be sued for.
People do not need their motor vehicles connected to the internet. Some people would prefer to not have this "feature" and do not like being forced to pay for it. This does not make them horse 'n buggy people.
[ link to this | view in chronology ]
Re: Hey there Elmer!
Our priorities are backwards. The only consistent theme that the government seems to be focused on is protecting corporate profits.
[ link to this | view in chronology ]
Re: Re: Hey there Elmer!
http://www-odi.nhtsa.dot.gov/owners/SearchYesterdayRecall
[ link to this | view in chronology ]
Re: Hey there Elmer!
[ link to this | view in chronology ]
Re: Hey there Elmer!
The lack of information regarding the patch is worrying. Did Tesla just fix a browser bug, as browser vendors do every few weeks? Or did they actually make sure the web browser is isolated such that no bug like this could ever happen again?
[ link to this | view in chronology ]
Pocket change!
Vulnerabilities will happen. The question is how fast the companies fix them. The answer is usually sluggishly slow or never and this is the worst problem.
[ link to this | view in chronology ]
Re:
Answering also to Jeremy Lyman: the difference between a browser exploit in a computer and the same thing happening in a car is that the car can be turned into a weapon instantly.
You don't need AKs or tons of bombs to kill 150 people: you just need a vulnerability in place, the proper stuff to exploit it and a highway full of cars at 120 Km/h (75 mph).
Moreover if you grab the proper car, namely a gas truck or something full of chemicals and other shit, and make an accident happen.
Browser vulnerabilities fuck up your stuff: car vulnerabilities can kill you.
I'd rather want the companies be EXTREMELY careful with what they do, and without backdoors that can be exploited.
[ link to this | view in chronology ]
A-B Test Required
And this would not be a problem for a human driver? Nobody ever has an accident or runs a red light because the sun on the horizon blinds them? Humans don't jump when a truck blasts off its air horn behind them?
[ link to this | view in chronology ]
Re: A-B Test Required
What if you could cause a crash by transmitting a radio wave or invisible light beam from a distant balcony? Nobody would suspect anything the first one or two times.
[ link to this | view in chronology ]
Where the rubber meets the road
Nowadays, at least in theory, a white hat hacker could take the wheel.
[ link to this | view in chronology ]