Slashdot Mirror
Tesla Fixes Security Bugs After Claims of Model S Hack (reuters.com)
An anonymous reader quotes a report from Reuters: Tesla Motors Inc has rolled out a security patch for its electric cars after Chinese security researchers uncovered vulnerabilities they said allowed them to remotely attack a Tesla Model S sedan. The automaker said that it had patched the bugs in a statement to Reuters on Tuesday, a day after cybersecurity researchers with China'a Tencent Holdings Ltd disclosed their findings on their blog. Tesla said it was able to remedy the bugs uncovered by Tencent using an over-the-air fix to its vehicles, which saved customers the trouble of visiting dealers to obtain the update. Tencent's Keen Security Lab said on its blog that its researchers were able to remotely control some systems on the Tesla S in both driving and parking modes by exploiting the security bugs that were fixed by the automaker. The blog said that Tencent believed its researchers were the first to gain remote control of a Tesla vehicle by hacking into an onboard computer system known as a CAN bus. In a demonstration video, Tencent researchers remotely engaged the brake on a moving Tesla Model S, turned on its windshield wipers and opened the trunk. Tesla said it pushed out an over-the-air update to automatically update software on its vehicles within 10 days of learning about the bugs. It said the attack could only be triggered when a Tesla web browser was in use and the vehicle was close enough to a malicious Wi-Fi hotspot to connect to it.
Slashdot reader weedjams adds some commentary: Does no one else think cars + computers + network connectivity = bad?
I disable Wi-Fi, Bluetooth, and location services on my phone when I'm not actively using them. Hopefully you can do the same for your car.
"Does no one else think cars + computers + network connectivity = bad?"
Does no one else think that phone + computer + network connectivity + radio connectivity + location sensing + chargeable services + .... + ... = bad?
Apparently only a few.
All of the systems (control, indication, locks/windows, climate control, infotainment, etc.) on any car should be separate and independent of each other. Also no safety critical system should have an transceiver with an antenna attached to it. Restrict over the air updates to non-safety critical systems and you will give the car a level of security similar to older cars.
> Does no one else think cars + computers + network connectivity = bad?
If modern society has taught us anything, it's that NOBODY CARES if it's "bad" or not. Certainly your psychopathic corporate overlords don't care.
Closing the barn door after the horse ran away because the barn was fully engulfed and about to collapse is the main MO of humanity.
"Does no one else think cars + computers + network connectivity = bad?"
Nope. Tesla was able to patch all their cars quickly, without asking drivers to come in to get serviced.
That's a net gain of: thousands of kms saved + time saved + less cars on road = good
A worse equation is that Tesla is working to eliminate:
Cars + humans + driving + distraction( texting | eating | doing makeup ) = bad
I think they've been on lithium ion for a while now.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
Connecting a car to anything is just stupid and reckless. It will be a constant battle with hackers. All AI should be on board.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
In real life this would not work on a moving car like hacks in the past for other vehicles, as you'd actually need to both be using the web browser and connecting to a malicious wifi. I mean, even if somebody is following you with a wifi hotspot, you'd still need to choose to connect to it and browse.
It is disappointing that they could jump from the web browser to other systems, but at least the over the air updates make such vulnerabilities (which exist and will exist in all our future devices as the trend is to make them "smart") easy to address.
"Claims of Model S Hack"
It's not a claim Reuters!!! The researchers reported the issues to Tesla, who fixed them. Tesla fixed them BECAUSE the hack worked. It's not a claim at all.
Does no one else think cars + computers + network connectivity = bad?
In principle no I do not. Cars have been loaded with computers for quite some time now for all sorts of good reasons. You just don't usually notice them - which is a good thing. As for network connectivity that is fine too. There are all sorts of useful things you can do with network access. Are there downsides? Sure, just like any technology. I haven't seen any showstoppers however. Just problems that will take some time to work through. I think the auto companies are going to struggle for a while to learn to deal with the security issues because they have no experience with them but they'll figure it out eventually. There also are some privacy issues but those too will eventually be sorted out to a reasonable degree.
Actually I think cars without computers are a much worse idea in most cases. Worse performance, worse fuel economy, more dangerous, less features, more maintenance, etc. I'm old enough to remember when cars mostly didn't have computers in them. They're better with computers.
The blog said that Tencent believed its researchers were the first to gain remote control of a Tesla vehicle by hacking into an onboard computer system known as a CAN bus
Ahahaha. That sounds like something from CSI. The computer is known as a "CAN bus?" Come on, guys. A college student in CS would catch that mistake. Obviously there are MANY computers connected by the CAN bus. There is no security on the CAN communications of any modern vehicles that I know of. Any person connected to the bus can masquerade as anyone else.
This is like saying scattering poison is not intrinsically bad because you only die if it gets in your food. The spread of combinations that only work if everyone is nice and no one is dangerously incompetent, and make things worse if anyone is, is intrinsically bad . Even in the absence of criminals wi-fi updated items that can kill if mishandled adds a certain power multiplier to any management stupidity in the company that makes them.
Hackers take control of Model S after claim of Security Bug fixes.
Perfect security is not possible, what level of risk counts as "done properly"? This is critical for devises that could be transformed into killing machines, or used to destroy critical parts of the road network, just by a software update. is the level of cost needed to reach that level of security even within reach of the car companies, or governments for that matter?
The question, put more precisely here is: why does a car need to be on a packet switched network?
Lots of reasons. Map updates, traffic updates, relaying location, weather updates, infotainment, concierge services, updates to car features, etc. The list is almost endless if one thinks about it.
The conclusion I come to is that as a convenience factor for the company, it's easier to have it on a network.
It's not just a convenience for the car company though that is a real factor. It's also a convenience for the car owner. If there is a recall on something software related (which happens a lot these days) it is MUCH more convenient for the car owner to not have to waste a substantial portion of the day scheduling time at a repair facility to have the problem fixed or the update applied. It's also much easier to receive a lot of useful updates (maps, traffic, weather, etc) via a network and in time I think there will be some interesting safety features relating to how cars talk to each other to avoid accidents and minimize traffic delays.
However, it opens up a huge attack surface.
Yes it does and I discussed this somewhat in the post you responded to. There are well understood ways to mitigate the attack surface problem. One thing that will be key is keeping certain operational features (access, ignition, etc) separate from non-safety and physical security features. I think there will be some hard lessons learned in regards to this...
Overall, it appears not to be much of a benefit to the owner of the car, as the owner could accomplish the noted updating tasks using a USB drive, and any required vehicle telemetry could be cached on-vehicle and retrieved manually as required.
Disagree. I see all kinds of utility in having a car that has two way communication. There are risks of course but they are reasonably well understood risks. In any case I see it as a moot discussion. Cars are going to get networks and it's something we should figure out how to do in the best way possible starting today.
Lots of reasons. Map updates, traffic updates, relaying location, weather updates, infotainment, concierge services, updates to car features, etc. The list is almost endless if one thinks about it.
So lets not put any of those things in a car. That's what tablets and phones are for.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
If you don't network you don't get security problems, autopilot and networked self-reprogramming autopilot are not the same thing.
The point about poison was that complaints about whether something is or in this case is not intrinsically bad outside of context are meaningless, poison is intrinsically bad as food but not as a killing tool for vermin.
Over the air updates are a danger, in the absence of criminals, as they encourage changes in a context where it makes seance to be very change adverse, due to the consequences of even a minor flaw, and that they make slow changes instantaneous. if you do not think it is possible for this to cause harm then imagine even the smallest repeat of the sort of flaws caused by windows 10 updates applied on a high speed road network, while bearing in mind the sort of miss-aimed management pressure that the resent emissions scandal revealed and its affects on responsible behaviour.
or your car is 1 year old to get that update to auto drive 1.5 buy A NEW CAR! or pay $2500 + labor to install an new CPU unit.
I think that AC may have stopped taking his lithium for too long
If you didn't like the way the car worked, you shouldn't have bought it.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Slashdot reader weedjams adds some commentary
Really? Linking tangentially related articles at the end of the summary wasn't retarded enough? Now we're just adding random comments?
Most folks are still in love with Tesla, but I have to wonder if they're going to be any different than John Deere and Case - New Holland:
"You are only given the privilege to pay the massive price tag, but you are FORBIDDEN to work on it. Bring it to us, along with your nose to pay thru."
>Does no one else think cars + computers + network connectivity = bad?
Not half as bad a wireless pacemakers.
How come people are shocked that it was possible to get from the internet to the control system of the car. How else have they been doing OTA firmware updates to implement new driverless features? I mean it's true. I mean they could have a separate computer inside the car that gets uploads of signed OTA firmware updates -- rejecting/alarming on any non signed files or out of bounds sFTP commands.
The CAN bus was developed decades ago when cars first got electronics.
It has no appreciable security standards. The devices on the bus can implement their own security features, but that becomes a problem when you want to include components from various vendors. Most of them never even thought of security.
The only security was physical security, and that vanished as soon as the wifi connected.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
> Does no one else think cars + computers + network connectivity = bad?
Does no one else think humans + metal + high speed = bad?