Slashdot Mirror
Tesla Fixes Security Bugs After Claims of Model S Hack (reuters.com)
An anonymous reader quotes a report from Reuters: Tesla Motors Inc has rolled out a security patch for its electric cars after Chinese security researchers uncovered vulnerabilities they said allowed them to remotely attack a Tesla Model S sedan. The automaker said that it had patched the bugs in a statement to Reuters on Tuesday, a day after cybersecurity researchers with China'a Tencent Holdings Ltd disclosed their findings on their blog. Tesla said it was able to remedy the bugs uncovered by Tencent using an over-the-air fix to its vehicles, which saved customers the trouble of visiting dealers to obtain the update. Tencent's Keen Security Lab said on its blog that its researchers were able to remotely control some systems on the Tesla S in both driving and parking modes by exploiting the security bugs that were fixed by the automaker. The blog said that Tencent believed its researchers were the first to gain remote control of a Tesla vehicle by hacking into an onboard computer system known as a CAN bus. In a demonstration video, Tencent researchers remotely engaged the brake on a moving Tesla Model S, turned on its windshield wipers and opened the trunk. Tesla said it pushed out an over-the-air update to automatically update software on its vehicles within 10 days of learning about the bugs. It said the attack could only be triggered when a Tesla web browser was in use and the vehicle was close enough to a malicious Wi-Fi hotspot to connect to it.
Slashdot reader weedjams adds some commentary: Does no one else think cars + computers + network connectivity = bad?
I disable Wi-Fi, Bluetooth, and location services on my phone when I'm not actively using them. Hopefully you can do the same for your car.
"Does no one else think cars + computers + network connectivity = bad?"
Does no one else think that phone + computer + network connectivity + radio connectivity + location sensing + chargeable services + .... + ... = bad?
Apparently only a few.
"Does no one else think cars + computers + network connectivity = bad?"
Nope. Tesla was able to patch all their cars quickly, without asking drivers to come in to get serviced.
That's a net gain of: thousands of kms saved + time saved + less cars on road = good
A worse equation is that Tesla is working to eliminate:
Cars + humans + driving + distraction( texting | eating | doing makeup ) = bad
I think they've been on lithium ion for a while now.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
Connecting a car to anything is just stupid and reckless. It will be a constant battle with hackers. All AI should be on board.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
"Claims of Model S Hack"
It's not a claim Reuters!!! The researchers reported the issues to Tesla, who fixed them. Tesla fixed them BECAUSE the hack worked. It's not a claim at all.
Does no one else think cars + computers + network connectivity = bad?
In principle no I do not. Cars have been loaded with computers for quite some time now for all sorts of good reasons. You just don't usually notice them - which is a good thing. As for network connectivity that is fine too. There are all sorts of useful things you can do with network access. Are there downsides? Sure, just like any technology. I haven't seen any showstoppers however. Just problems that will take some time to work through. I think the auto companies are going to struggle for a while to learn to deal with the security issues because they have no experience with them but they'll figure it out eventually. There also are some privacy issues but those too will eventually be sorted out to a reasonable degree.
Actually I think cars without computers are a much worse idea in most cases. Worse performance, worse fuel economy, more dangerous, less features, more maintenance, etc. I'm old enough to remember when cars mostly didn't have computers in them. They're better with computers.
There are probably hackers reading about this and thinking, "Challenge accepted!".
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
This goes directly against the whole Autopilot philosophy. In your example, people are expected to be capable of using poison properly and responsibly. If you spread it around and someone doesn't use it properly, well, it's not your fault. Didn't you read the small sign in the corner of the yard? What makes it more interesting is that automation is being pushed on the premise that humans aren't perfect, yet expect perfection from them in other ways? It's a strange way of thinking.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
The question, put more precisely here is: why does a car need to be on a packet switched network?
Lots of reasons. Map updates, traffic updates, relaying location, weather updates, infotainment, concierge services, updates to car features, etc. The list is almost endless if one thinks about it.
The conclusion I come to is that as a convenience factor for the company, it's easier to have it on a network.
It's not just a convenience for the car company though that is a real factor. It's also a convenience for the car owner. If there is a recall on something software related (which happens a lot these days) it is MUCH more convenient for the car owner to not have to waste a substantial portion of the day scheduling time at a repair facility to have the problem fixed or the update applied. It's also much easier to receive a lot of useful updates (maps, traffic, weather, etc) via a network and in time I think there will be some interesting safety features relating to how cars talk to each other to avoid accidents and minimize traffic delays.
However, it opens up a huge attack surface.
Yes it does and I discussed this somewhat in the post you responded to. There are well understood ways to mitigate the attack surface problem. One thing that will be key is keeping certain operational features (access, ignition, etc) separate from non-safety and physical security features. I think there will be some hard lessons learned in regards to this...
Overall, it appears not to be much of a benefit to the owner of the car, as the owner could accomplish the noted updating tasks using a USB drive, and any required vehicle telemetry could be cached on-vehicle and retrieved manually as required.
Disagree. I see all kinds of utility in having a car that has two way communication. There are risks of course but they are reasonably well understood risks. In any case I see it as a moot discussion. Cars are going to get networks and it's something we should figure out how to do in the best way possible starting today.
Lots of reasons. Map updates, traffic updates, relaying location, weather updates, infotainment, concierge services, updates to car features, etc. The list is almost endless if one thinks about it.
So lets not put any of those things in a car. That's what tablets and phones are for.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
or your car is 1 year old to get that update to auto drive 1.5 buy A NEW CAR! or pay $2500 + labor to install an new CPU unit.
I think that AC may have stopped taking his lithium for too long
If you didn't like the way the car worked, you shouldn't have bought it.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
If you ask the "right" people, apparently the barn has been "fully engulfed and about to collapse" for thousands of years now. Shit happens, we fix the shit, and try to get it as right going forward as is reasonably possible. The way people talk, it's like some kind of massive collective failure that will bring about the end of days *any day now* that humans are not perfect.
"Old man yells at systemd"
Slashdot reader weedjams adds some commentary
Really? Linking tangentially related articles at the end of the summary wasn't retarded enough? Now we're just adding random comments?
Most folks are still in love with Tesla, but I have to wonder if they're going to be any different than John Deere and Case - New Holland:
"You are only given the privilege to pay the massive price tag, but you are FORBIDDEN to work on it. Bring it to us, along with your nose to pay thru."
>Does no one else think cars + computers + network connectivity = bad?
Not half as bad a wireless pacemakers.
The CAN bus was developed decades ago when cars first got electronics.
It has no appreciable security standards. The devices on the bus can implement their own security features, but that becomes a problem when you want to include components from various vendors. Most of them never even thought of security.
The only security was physical security, and that vanished as soon as the wifi connected.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Correct. :*)
There is no security on the CAN communications of any modern vehicles that I know of. Any person connected to the bus can masquerade as anyone else.
That's why Tesla has several layers of bus, with firewalls between them, inside each car.
Get on one of the buses, you get to tweak the stuff on THAT bus. But you have to convince a firewall you're cool (i.e. doing something the firewall recognizes as legitimate) before it forwards your transaction to anything on even an adjacent bus.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way