Slashdot Mirror
Tesla Model S REST API Authentication Flaws
An anonymous reader writes "New Tesla owner and Executive DIrector of Cloud Computing at Dell, George Reese, brings the Tesla Model S REST API authentication into question. 'The authentication protocol in the Tesla REST API is flawed. Worse, it's flawed in a way that makes no sense. Tesla ignored most conventions around API authentication and wrote their own. As much as I talk about the downsides to OAuth (a standard for authenticating consumers of REST APIs—Twitter uses it), this scenario is one that screams for its use.' While not likely to compromise the safety of the vehicle, he does go on to say, 'I can target a site that provides value-added services to Tesla owners and force them to use a lot more electricity than is necessary and shorten their battery lives dramatically. I can also honk their horns, flash their lights, and open and close the sunroof. While none of this is catastrophic, it can certainly be surprising and distracting while someone is driving.'"
Can someone give me a car analog?
The Tesla Model S will not allow you to run any controls remotely while you are driving even when logged into the iOS as a validated user. One can't honk the horn, flash light, vent the sunroof or unlock/lock the car while it is moving.
Hopefully a light will come on over at Tesla about API security. Let's just hope it's not a Phillips Hue (http://www.engadget.com/2013/08/14/philips-hue-smart-light-security-issues/)
It seems pretty obvious that while an attacker couldn't directly cause an accident, say by taking over steering/acceleration/braking, there are many ways that the driver could be distracted, and distracted driving is extremely hazardous.
Of course, the real problem the author identifies is that someone could track your location(!). Obviously, inconspicuousness is a high priority for someone navigating public roads in a cutting edge automobile.
Well, terminal velocity will depend on two factors: The ultimate wind resistance of its tumbling chassis, and how high it is above the ground when you drop it.
I've fallen off your lawn, and I can't get up.
There's something of a difference between "hey, look, some guy in a neat car" and "John Q. Private is currently at mile marker 23 on highway 2, proceeding at 65 mph in an easterly direction, with 100 miles of range remaining."
I've fallen off your lawn, and I can't get up.
With all the news about medical devices with deadly security flaws, and people even hacking into cars (even if only from the backseat), I can't believe Tesla really didn't even *try* to add proper security to their API. The only right way to do it (from a corporate perspective) is to hire an outside security company to audit your design and implementation, and to continue to monitor the security whenever changes are made (so continuously in this case). It's well known that you can't trust the programmers to implement security properly, especially if you had Elon Musk screaming over your shoulder like Steve Jobs all the time.
"I have never let my schooling interfere with my education." - Mark Twain
"I can also honk their horns, flash their lights, and open and close the sunroof."
So he discovered a 10 year old?
Solving Unix problems since 1989...
It's fast as hell. It can do 0 - 60 in 4 seconds despite weighing 4600 pounds. Electric motors operate at max torque at all RPMs.
In a world of interconnected devices (the Internet of Things), it's not about hypothetical sites. It's about real, interconnected sites. There are real sites out there that talk to Teslas and provide value beyond what Tesla provides. If you are building a connected device in 2013, you should take this reality into account.
Sure. It is like using web based certificates in PKI but in this case there is no revocation system and mandatory 3 month validity for all certs. I have to give this key to a third-party in order to be able to do anything user related like view my emails. That third-party or someone who gains access maliciously to the cert database can use this cert to make a connection to my computer that I can't turn off, to make my cpu spike or use up all the ink in my printer, until the 3 months is over.
...wait a minute, I think I did this wrong
I'd said I flashed your lights mama
your horn won't even blow
I even flash my lights mama
this horn won't even blow
Got a short in this connection
hoo-well, babe, its way down below
When the speed limit is 55.
Alternatively, when someone correlates driving patterns with murders and determines that you were parked in the parking lots of restaurants that were within walking distance of three unsolved murders. Can you prove you were eating? The whole time?
Yes, I can think of a lot of scenarios where you might care.
Check out my sci-fi/humor trilogy at PatriotsBooks.
I'd say being able to flash someone's headlights if they're driving on a winding, unlit road, at night, could most certainly be catastrophic.
Tesla is a big target in the crosshairs of the automotive industry right now so I'm very skeptical. Tesla is doing what no other company has been able to do in the US and that seems to be a problem with everyone from dealers to falsified reviews in The New York Times. Let's do without the TFA drama have a look at the the egregious attack vectors listed:
1) You want to leverage a tool on a website with some useful functionality. You enter your email/password. They willfully and incorrectly store that information and are subsequently compromised (or worse, they use it themselves).
This is a really broad claim. What's more, if you haven't logged in over an SSL connection then... well, you're kind of a dumbass.
2) An attacker gains access to a website's database of authenticated tokens. It has free access to all of that siteâ(TM)s cars up to 3 months with no ability for the owners to do anything about it.
This is no less dubious that so many online services that I couldn't begin to count. The risk of compromise is an accepted one and hopefully mitigated. No fair faulting them without seeing how they would handle said compromise.
In a nutshell, TFA is going to need to find more substantial basis for panic than this. Sheesh.
Join the Slashcott! Feb 10 thru Feb 17!
And the stupidest phrase ever award goes to:
Internet of Things!
The Kruger Dunning explains most post on
Read the article. This 'flaw' requires a Tesla owner's email address AND password to 'exploit'.
...are doomed to so so in a way that is somewhat less secure but infinitely more usable.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Like the fact that Tesla's API is closed and 3rd-party applications are unauthorized and using it without any documentation other than what's been figured out through reverse-engineering. No doubt they need to do some work before publishing an API, but there's no warranty when you use homebrew.
Eagles may soar, but weasels don't get sucked into jet engines.
"RPMs" has been a standard abbreviation for "Revolutions Per Minute" since... well, probably since the advent of reciprocating assemblies.
Where the hell have you been?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
This brings 2 questions to mind:
1) Can an attacker use this exploit to remotely alter the heat and A/C settings?
2) Presuming the answer to 1 is yes, couldn't they use said exploit to overheat the element or over-cycle the compressor, causing a fire?
Third, kinda related question: Knowing that compressor motors and heating coils are the biggest amp draws in any circuit, how much does heater or A/C usage affect range? As in, running the A/C | heat at full blast would reduce the range from ~300 miles to what?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Say I am John Q. Private. Can you give me a scenario where I might care that someone has this information?
A stalker, your spouses lawyer, just to name a couple.
It's not a case of 'what can they do', or 'I have nothing to hide', but rather a case of 'it should not be that easy'.
The article is mostly FUD. To start, OAuth is not a User->System authentication system, its a three party authentication system. For OAuth to work as intended the three parties involved need secure communication channels between the pairs (e.g. user to api, 3rd party to api, and user to 3rd party). This leads to the fact that his first two complaints about the Tesla service, are also inherently present in OAuth when implemented in a non-web app:
* Entering login information into any application inherently provides it to the application's author
* SSL is required between the 3rd party and the API service, otherwise eavesdroppers are able to obtain the API token, secret and user token
The final two flaws are really the same issue and are not part of authentication; however it is important that users are able to revoke access that they've provided to third parties. Missing that ability is certainly a problem but it is not a flaw with authentication.
While there are better methods for authentication that ought to be used by Tesla for their API (e.g. a long one time token the user enters, a QR code scanned, etc.), OAuth is not a better form of authentication for desktop or mobile application.
The only other 4 door car that can do 0-60 in 4 seconds is the M5. Comparing a 5 passenger sedan to a 2 seater roadster isn't fair. It's also $30k less than your Roadster and almost every other car with sub 4 second 0-60 times.
The Z06 isn't the pinnacle of good car handling. Heck, a $50k base Boxster is superior. American tastes I guess.
In a normal gas powered car with multiple gears, when you shift gears and drop the RPMs down, you lose torque and acceleration. In an electric car, which typically only have one gear, the car accelerates smoothly and evenly.
Electric motors operate at max torque at all RPMs.
RPMs - is that Revolutions Per Minutes?
Actually, yes. (Revolutions Per Minute)s.
If you're talking about a single angular velocity, use RPM. (The tach reads 'RPM', not 'RPMs'.)
But the GP used the phrase "at *all* RPMs", so he was clearly talking about multiple angular velocities.
John Q. Private is currently at mile marker 23 on highway 2, proceeding at 65 mph in an easterly direction, with 100 miles of range remaining.
Say I am John Q. Private. Can you give me a scenario where I might care that someone has this information?
I really can't think of anything bad that could happen to me if that information fell into the wrong hands. Or at least, nothing worse or more likely than many things that could already be done to me by someone with far less information.
My car physically suddenly misbehaving, even if limited to peripheral systems -- that I can easily imagine causing a distraction and subsequently an accident.
Twenty miles due east of John Q. Public's current location, cellular services cease. Police response time to that location is estimated at 2.5 hours minimum. John Q. Public is driving a really expensive car, may be wearing expensive bling, and almost certainly has credit cards in his possession.
You can't think of anything bad that could happen?
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
Say I am John Q. Private. Can you give me a scenario where I might care that someone has this information?
I really can't think of anything bad that could happen to me if that information fell into the wrong hands. Or at least, nothing worse or more likely than many things that could already be done to me by someone with far less information.
Millions of restraining orders issued in the US every year. Not everyone has the luxury of not having to worry about who all might be out to get them. 1.5-2k women murdered per year in US by their SOs. You obviously have no idea what it is like to have to constantly watch over your shoulder. I hope you never do.
Maybe he should be, and just doesn't realize it yet.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
It is a button press away to turn off remote access on the Tesla S console so if an owner is concerned they can turn the interface off. TFA implies that if you give away your credentials and get hacked, you're screwed for 3 months which is not true. Tesla warns repeatedly to be very careful about who you give your user name and password to, not that doing so creates a danger, they are just trying to educate their owners. Tesla's use of a proprietary system as opposed to OAuth isn't necessarily wrong or less secure. It does however point to a more interesting policy; Tesla will have more of an Apple style walled garden than a wide open Android marketplace for anything that communicates with the car. Finally the whole business of economic loss and damage to the batteries is silly. I seriously doubt that less than a dollars worth of electricity if somebody turns the air or heater on are going to be an issue for the typical Tesla owner. And no, the interface does not allow you to turn on the heater and the air conditioning at the same time - you can set the target temperature for the interior. Nobody is going to put up with this happening all the time and suggesting battery damage by using the car in a way it was designed to do exposes the article for what it is.
Greed is the root of all evil.
Nitpick - max power at all RPMs. If a power source supplies a constant 10kw, the electric motor will of course operate at a constant power of 10kw. It should be obvious that 10kw equates to very different torque values a 1 rpm and 10,000 rpm.
The advantage of electric motors, which you allude to, is that the max power (150 kw, 200 hp, whatever) is available immediately, rather than only once engine revs climb high enough like in a petrol engine. (Although due to real-world esoteric reasons I don't fully understand, the efficiency with which that power is turned into motive force isn't constant throughout the rev range - max torque of many electric motors is actually not right at 0 rpm, but the concept is close enough to reality to illustrate the differences between electric motors and internal-combustion engines.)
So a Tesla Model S will essentially operate at 310 kw regardless of engine speed, while an ICE with the same peak power output will generate 310 kw only at one specific RPM, and will be less, sometimes a lot less, at all other speeds.
ps - why is one a "motor" and another an "engine?" What's the difference?
Much of Tesla's criticism of the Times was based on , supposedly, data that Tesla downloaded from the test vehicle.
Does this security flaw make it more likely that tesla, or a tesla employee, could have altered the data ?
Say I am John Q. Private. Can you give me a scenario where I might care that someone has this information?
A stalker, your spouses lawyer, just to name a couple.
It's not a case of 'what can they do', or 'I have nothing to hide', but rather a case of 'it should not be that easy'.
I was thinking something more along the lines of "Hmm... let's see if there are any Teslas in the area right now. Oh, there's one that's parked over in the shopping district! I think I'll go over, open the sun roof and see if there's anything I like inside...."
You're driving around in a potentially $90k vehicle which contains theft deterrents that pretty much only work when the car is locked and hasn't been started yet. Please tell me you're not daft enough that you fail to see how the information you listed could be put to use in a way that would deprive you of your shiny new toy.
Note to self: never drive Tesla in Florida.
According to MIT, not really anything these days.
They both came to describe the same thing from two different linguistic directions. It seems the only distinction between the terms these days is more rooted in nomenclature within a specific discipline and less on overall semantic accuracy.
Culture is more than commerce
Rest assured that the matter will be taken care of... And the trick will be to honk the car of Mr. Musk and it will be taken care of promptly.
It's funny how I make sense to others and not myself...
Maybe I'm waiting to break into your house, and I want to know where you are currently at so I don't get caught....
Visit the Arcade Restoration Workshop @ http://www.arcaderestoration.com
> why is one a "motor" and another an "engine?" What's the difference?
In modern usage an engine is a device that burns fuel to generate torque. Historically it was used for any device that converts force into motion: hence battering rams and catapults being siege engines, and the cotton (en)gin(e).
Motors apply to pretty much everything else that might once have been called an engine. Most commonly they convert electrical, elastic, or compressed-gas energy into mechanical energy. But there are even molecular motors such as the myosin in muscles that converts chemical energy into mechanical work.
My personal rule of thumb - if it's powered by heat it's an engine. Heat being a very low-quality form of power it suffers from large and theoretically unavoidable thermodynamic inefficiencies when converting to higher-quality forms. An electric or spring-driven motor on the other hand could, in theory, be 100% efficient.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
Certain electric motors have max torque at zero rpm. DC motors with series wound fields do (eg. Starter motors) . The AC motor in the Tesla will have a lot of torque at zero rpm, but I'll wager that there is a higher value somewhere above zero.
You are in a twisty maze of processor lines, all alike.
There is a lot of hype here.
If presumption of innocence can be eliminated based solely on where your car was parked I think you've got way bigger problems to worry about.
Well the boxster has a maximum lateral acceleration of 1.0g, while last years corvette has a maximum lateral acceleration of 1.13g, so I would say you don't know your cars very well. Every major car reviewer disagrees with you, including edmond's, motortrend, etc. Please go away.
I should also note that the $50k Boxster is worse in handling (1.0g vs 1.13g), acceleration 0-60 (5.1s vs 3.6s), quarter mile (12.7s vs 11.6s), the figure 8 test, and slalom runs. Of course, you could add an auto trans to drop it's 0-60 to 4.5s, but that isn't the base model as you claim, and it's still not even in the same ballpark as 3.6s. The boxster doesn't even perform as well as the baseline corvettes, so your comparison is silly.
There are a few others, like the Cadillac CTS-V Sedan can do it in 3.9s, the Mercedes E63 AMG Sedan in 3.8s, etc.
What's the phrase? Once is chance, twice is a coincidence, three times is a pattern.
Check out my sci-fi/humor trilogy at PatriotsBooks.
If you look at that API and you think it's REST, then you don't know what REST is. Here's Roy Fielding's blog post where he points out that these types of APIs aren't REST. Roy Fielding is the guy that described this architectural style and coined the term "REST" in the first place.
Here's one example: You perform a GET request at /vehicles to obtain a list of vehicles. These vehicles take the form of JSON data, including an id attribute. If you want to perform operations on a vehicle, you need to construct URLs of the form /vehicles/{id}/.... That is not REST.
REST is hypertext driven. It revolves around content types, not manual URI construction. If that were a RESTful API, it would describe a vehicle list media type, and that media type would contain URIs, not IDs that you have to construct new URIs from using out of band knowledge. Their approach is like if every web browser was hard-coded to find articles at /articles instead of using links. It's dumb.
This misunderstanding is far too common. Don't guess at what REST is when you construct an API like these guys did, look it up for yourself.
Bogtha Bogtha Bogtha
I've done 4.9 in my stock 2012 SRT8 Charger, and I'm sure it's capable of doing better than that.
Just another day in Paradise
Why is this an issue?
Everything is secure, as long as a malicious piece of code doesn't steal the users' username, password and/or temporary authentication token. So - how would they claim to permit any type of login without this information being on the device - unless you make the user enter a password on every login (which I guess could still be snooped). Pretty much every authentication system I can think of - from "plain", to Kerberos to things with session tokens have a vulnerability where if someone could "steal" a piece of data (like a token) one could get in. The only real way around it would be to perhaps put a two-factor authentication system with a very short timeout - but that just closes the window and makes it more annoying for the user.
So - what is this article really getting at???
The advantage of electric motors, which you allude to, is that the max power (150 kw, 200 hp, whatever) is available immediately, rather than only once engine revs climb high enough like in a petrol engine.
Nitpick - The torque on an electric motor vs RPM varies significantly based on winding type. For some motors, like a DC series-wound, you have an incredible amount of torque at 0 RPM (which is why they are used for starter motors). There are others - such as AC synchronous motors- that have nearly any torque at startup, and are usually built with a second motor on the same shaft to try to get the unit turning under load. Given a constant power source (i.e. voltage) the internal resistance (and hence current draw, and hence, by definition, power) will vary over RPM.
That said, on average, I think we all agree the torque curve is WAY more impressive than either a diesel or a gasoline engine (both of which have different torque curves).
For us carnivores, "Sucking the marrow out of life" isn't a transcendentalist philosophy but a practical instruction.
Awesome, thanks for that - those are some of the "real-world esoteric reasons I don't fully understand" that I mentioned in my previous comment.
Dang. Learned another new thing today. Thanks.
Oh yeah. The CTS-V is a monster.
What's the phrase? Once is chance, twice is a coincidence, three times is a pattern
At least in Goldfinger, the third time is "enemy action." Got Mr. Bond James Bond in a little trouble.
https://app.box.com/WitthoftResume Code: https://github.com/cellocgw
http://en.wikipedia.org/wiki/Internet_of_Things