Slashdot Mirror
Android Malware Used To Hack and Steal Tesla Car (bleepingcomputer.com)
An anonymous reader writes: By leveraging security flaws in the Tesla Android app, an attacker can steal Tesla cars. The only hard part is tricking Tesla owners into installing an Android app on their phones, which isn't that difficult according to a demo video from Norwegian firm Promon. This malicious app can use many of the freely available Android rooting exploits to take over the user's phone, steal the OAuth token from the Tesla app and the user's login credentials. This is possible because the Tesla Android app stores the OAuth token in cleartext, and contains no reverse-engineering protection, allowing attackers to alter the app's source code and log user credentials. The OAuth token and Tesla owner's password allow an attacker to perform a variety of actions, such as opening the car's doors and starting the motor.
When you can get a tow truck and lift the Tesla onto it.
Tesla has responded that they wont be responsible for weaknesses in the platform running the app. Which is reasonable.
So - don't store a "car key" or anything of value in a phone app at this time.
Apps for controlling the stereo, map displays or extracting car computer logs are fine. But nothing that lets you take the car itself. Bringing and using a car key is not hard.
There is a law suit I am smelling here. Am I alone?
Here is another take on the same story: https://electrek.co/2016/11/23...
This has nothing to do with the subject.
If you give the right to your phone to start your car, don't expect your phone not to be hacked, watever the phone O.S.
Also in general, don't expect your phone not to be hacked.
aaaaaaa
I can steal one by hitting people with a Nokia phone and it isn't limited to one brand of cars.
You can also use a toaster if it runs Linux.
Seriously, this is just another "via the Internet" thing that is used with almost anything to pretend it is something new. The article is "You can steal a car if you steal the keys".
Don't fight for your country, if your country does not fight for you.
Here’s a good way to look at it: when you have a car that can be unlocked and driven using an app on your phone, your phone becomes a key to your car.
Wrong!
When you have a car that can be unlocked and driven using an app on your phone the car manufacturer is a fucking hipster.
I get why is a bad idea to let the OAuth token lying around in cleartext (shouldn't Adroid's compartmentailzation make sure only the relevant app has access to this? But hey, security by layered obfuscation still good for surprises, I guess).
But what the fuck is "reverse engineering protection"?
A Tesla does not need starting. Maybe switching on, or more likely going from standby mode to full power mode. Starting is for engines that burn fossil fuels.
actually,...
Do expect Android to be hacked and all your info leaked to cave monkeys handling Google's development in some smelly jungle.
Google getting all your data via Android is neither a hack nor a leak.
It's a feature.
To using Tesla autopilot to steal the car for you and having it drive itself to any location you specify.
Everything is hackable. Film at 11.
You can easily take over a device if you succeed in convincing targeted user to install a malicious app, other news at 5.
You don't even need an OS and the battery life is better. Just club someone with a sock full of batteries (don't even need to be LiPos). You don't even need to charge the batteries.
You seem to be having some trouble wielding the english language.
It would be cool though if I could plug in an xbox controller to drive with.
I miss the days where a company would be considered a bad company if they blamed customers for problems that happened with something they created and sold as a feature.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Tesla has its part of the blame. Not for the car, but for the Android app. Probably outsourced it to a webdev firm.
Bit of a biased article calling it specifically "Android malware", when the same malware exploiting the same security issue on Tesla's part (oauth as plaintext) on iOS would work the same way.
To use this one would have to specifically target the android phone of a specific Tesla owner.
If someone wants to steal a specifically single person's car there are vastly easier ways to do it. Such as, hold a gun to the person's head and demand they turn over the key.
None of this was done in the wild, making the title needlessly click baity.
I'm a good cook. I'm a fantastic eater. - Steven Brust
"Since Android was launched over seven years ago, all Android devices have
shared a common security model that provides every application with a secure,
isolated environment known as an application sandbox. Android was one of
the first operating systems to introduce the idea of sandboxing to both protect
applications from attacks and protect the device from applications. Sandboxing
is used for all applications on the device, including system-level applications. "
https://static.googleuserconte...
iOS has had its share of remote exploitable root access vulnerabilities over the years, sandboxing (which Android does too) can't stop you once you have root.
Actually, the NHtSA and Other regulatory agencies have completely abdicated on their responsibility to ensure safety in the field of software assurance. Only the EPA has done anything to require that software be demonstrated to be correct or have any protection from hacking. Insurance companies, to an extent, do, but they are only reactive in that mode.
If I use a Samsung Galaxy Notes 7 to steal a Tesla, what happens ?!?
People saying they can club someone and steal their keys are morons.
While true, it adds assault or murder to the charges if/when caught. Quite likely increases the likelihood of detection.
Also, the keys are not stolen. Just copied. So those analogies are also wrong.
My Android developer take on this same story:
It is Tesla's fault. Why?
They decide which target sdk and which min sdk version they support (compile sdk doesn't really matter for liability purposes). They should be aware of the consequences of supporting older versions. If they use a feature that is vulnerable in one of the versions they support, it's CLEARLY their fault ;-)
This reminds me of a question I once answered - someone wanted to store passwords on Android's SharedPreferences for "remember password" feature. Someone told them to use SharedPreferences. I replied stating SharedPreferences can be seen in cleartext if the an app is using root to poll the filesystem (SharedPreferences' defense is nothing more than storing them in filesystem encrypted files, which # simply bypasses). Whose fault is it that a phone is rooted/rootable or that the app escalated by itself? Doesn't matter. These are clear case of snowball growing, but in practice, if you're using a feature of an API for which you can see the source (because you can, it's AOSP...), you're always to blame for the dangers you put on your software. I learned that the soft way, and so did Tesla - they better prevent the hard way from happening with a quick fix. As they probably are storing the token in a SharedPref, the secure-preferences lib probably solves their problem or heavily mitigates attacks.
Trying to prevent reverse engineering is pointless, all you can do is make things more difficult and in doing so, making your code more complicated and harder to debug or potentially unreliable.
The fact is if you access something from a compromised device then you run the risk of whatever you're accessing being compromised too.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
If you have rooted the OS then it would still be possible to do this type of exploit, even on iOS. Just would need to proxy the network code so that it looks for the OAuth token and sends it somewhere before applying the SSL encryption. Or if the token is stored in the keychain it would be possible on a rooted device to access the keychain ignoring the sandboxing walls.
"Since Android was launched over seven years ago, all Android devices have
shared a common security model that provides every application with a secure,
isolated environment known as an application sandbox. Android was one of
the first operating systems to introduce the idea of sandboxing to both protect
applications from attacks and protect the device from applications. Sandboxing
is used for all applications on the device, including system-level applications. "
https://static.googleuserconte...
Well, thank you for the dissertation here, but unfortunately this has done FUCK ALL to actually prevent or protect consumers using the Android ecosystem.
The fucking pathetic part is it's become so systemic that it appears Android consumers want it that way.
You mean I have to switch to an Android to steal Teslas? I'm sorry, but that's a deal breaker.
it's a webapp.
uses a web service.
doesnt matter when if rooted the text input can be read anyways. the article is stupid.
and you're simply doing what you were told
WARNING: Smartphones have side effects--most of them undocumented.
Make a claim that is easily proven wrong. Have someone refute claim with evidence. Move goalposts. Whine about something else. Rinse. Repeat.
So let me see if I understand correctly, if you download and install malware on your Android device, you'll get hacked, just where is the technology angle?
English, a spoken language, evolved with a set of noise-tolerant redundancy features. If you didn't understand that, the trouble is yours as well.
Aren't Teslas so connected that stealing them can only be a short term endeavor?
Maybe you'd get a joyride out of it, but the car is totally trackable so you'd better make it real short.
Teslas are 13x less likely to be stolen than an average car according to Teslas are hard to steal.
The reasons are multifold. Starting the car and driving it off is the easy part. The few Teslas stolen to date have been largely due to what might be considered extreme negligence on the owners part - like leaving the doors open and the fob inside.
But is that negligence? The car is totally connected and obscenely trackable. Getting away with stealing a Tesla would mean disconnecting it forever and thus losing a lot of its value. For example, you could never get a free recharge. I wonder how many of those few cars stolen have been recovered. I'd bet the number is high.
So, you steal it for parts? Wrong! There is virtually no used parts market. Tesla owners tend to buy their parts new.
It seems that the best you could hope for is likely a very quick joyride.
My question is "why this article now"? It is very sensationalist. I'm not questioning the efforts of those who found and reported the attack route. But why widely disseminate it to the general public without noting that Teslas are amongst the least likely to be stolen cars in the world. Is this an attack piece?
Security 101
1. If you can do something remotely, so can someone else.
"Grab them by the pussy" -- President of the United States of America
Except that apps can write encrypted information inside their sandbox.
I see many people blaming Tesla, but in my opinion, assuming the OS can keep a cookie secret is not a security mistake. The flaw is in the OS here.
Is it called Edison?
some people are a "glass half empty" some are "glass half full" i'm a "there is something in the glass be happy" person
The same Slashdot that warns us about fake Anti-Tesla stories serves up one itself, literally on the SAME DAY!
This story is false on three counts (A) The hack was possible not because of the Tesla app but because of a weakness in the Android Operating system. (B) the flaw in the operating system had already been patched before the hack and before the story went out. (C) No Tesla vehicle was actually stolen by this hack. Indeed Tesla cars are amongst the safest when it comes to theft prevention.
See: https://electrek.co/2016/11/23/tesla-hacker-steal-car/
This:
Sand boxing apps has been around forever since JS started and has done shit else to prevent malware from executing. Ride that hype train bro.
I just need you to install this free app from a developer you have never heard of...