Slashdot Mirror

← Back to Stories (view on slashdot.org)

Tesla Model S Hacking Prize Claimed

Posted by Soulskill on from the to-the-victors-go-the-electric-spoils dept.

savuporo sends word that a $10,000 bounty placed on hacking a Tesla Model S has been claimed by a team from Zhejiang University in China. The bounty itself was not issued by Tesla, but by Qihoo 360, a Chinese security company. "[The researchers] were able to gain remote control of the car's door locks, headlights, wipers, sunroof, and horn, Qihoo 360 said on its social networking Sina Weibo account. The security firm declined to reveal details at this point about how the hack was accomplished, although one report indicated that the hackers cracked the six-digit code for the Model S's mobile app.

6 of 59 comments (clear)

  1. Not how this is supposed to work... by iluvcapra · · Score: 3, Interesting

    The security firm declined to reveal details at this point about how the hack was accomplished

    So it could be a hoax, but more likely they're black-hatting in public view.

    --
    Don't blame me, I voted for Baltar.
    1. Re:Not how this is supposed to work... by Ol+Olsoc · · Score: 4, Funny

      Only if they don't tell Tesla. In fact until they tell Tesla and give them some time to get a fix, they probably shouldn't tell the general public.

      Oh my fucking God!

      Do you mean to tell me that someone might be able to gain control of a car now!

      Those Fuckers at Tesla will cause the downfall of civilization!

      We have had cars for well over a hundred years now, and it looks like Tesla is the only company that has cars that can be stolen!. Shit! First fires, now stolen vehicles.This electrical car thing isn't going to work at all.

      Umm, Thanks, Obama!

      --
      The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
  2. So by bswarm · · Score: 2

    Basically they guessed the password to gain control of the accessories you can operate with an android app? Some hacking job there, lol.

    1. Re:So by ShanghaiBill · · Score: 3, Interesting

      Basically they guessed the password to gain control of the accessories you can operate with an android app? Some hacking job there, lol.

      If that is what they did (and we don't know that) then that is a security flaw. Tesla should not have allowed the PIN to be brute forced. The PIN should be stored by the car, not by the app, and it should have a 30 second lock-out after 3 wrong attempts, and then double the lock-out time for each additional wrong attempt. This is Security 101.

    2. Re:So by unrtst · · Score: 3, Insightful

      Tesla should not have allowed the PIN to be brute forced. The PIN should be stored by the car, not by the app, and it should have a 30 second lock-out after 3 wrong attempts, and then double the lock-out time for each additional wrong attempt. This is Security 101.

      At which point, anyone in the world could very very easily DOS your car.

      There are ways around that, but the naive and very very common implementation you describe is trivial to DOS. I'd hope that the users key could still get them in and get an override, but the app should use much stronger auth to avoid DOS issues (ex. challenge response with something that requires largish compute time for the client in order to register and calculate a very large shared key - ie. this would be a one time registration per client app; then use the lock out on a per-registered-client basis; thus is would be costly to generate more client ids, and the lock out would make each only worth a few bad tries before forcing re-handshake). PIN would still be used on top of that (adds another factor, and something easily set/changed on the car side).

    3. Re:So by ShanghaiBill · · Score: 2

      At which point, anyone in the world could very very easily DOS your car.

      Nope. The car should only accept PIN attempts from pre-registered devices. So in order to DOS your car, the DOSer would have to first steal your cell phone.