Slashdot Mirror
Android Malware Used To Hack and Steal Tesla Car (bleepingcomputer.com)
An anonymous reader writes: By leveraging security flaws in the Tesla Android app, an attacker can steal Tesla cars. The only hard part is tricking Tesla owners into installing an Android app on their phones, which isn't that difficult according to a demo video from Norwegian firm Promon. This malicious app can use many of the freely available Android rooting exploits to take over the user's phone, steal the OAuth token from the Tesla app and the user's login credentials. This is possible because the Tesla Android app stores the OAuth token in cleartext, and contains no reverse-engineering protection, allowing attackers to alter the app's source code and log user credentials. The OAuth token and Tesla owner's password allow an attacker to perform a variety of actions, such as opening the car's doors and starting the motor.
There is a law suit I am smelling here. Am I alone?
Because a tow doesn't start the car.
If you tow it away, typically you would like to start it afterwards.
aaaaaaa
Here is another take on the same story: https://electrek.co/2016/11/23...
This has nothing to do with the subject.
If you give the right to your phone to start your car, don't expect your phone not to be hacked, watever the phone O.S.
Also in general, don't expect your phone not to be hacked.
aaaaaaa
I can steal one by hitting people with a Nokia phone and it isn't limited to one brand of cars.
You can also use a toaster if it runs Linux.
Seriously, this is just another "via the Internet" thing that is used with almost anything to pretend it is something new. The article is "You can steal a car if you steal the keys".
Don't fight for your country, if your country does not fight for you.
you dont really "start" a electrical car do you?
actually,...
Do expect Android to be hacked and all your info leaked to cave monkeys handling Google's development in some smelly jungle.
Google getting all your data via Android is neither a hack nor a leak.
It's a feature.
Everything is hackable. Film at 11.
It would make for a funny zero-day situation, where someone simultaneously steals every net-connected Tesla in the US, orders them to drive to a friend's house, and then shuts down all external communication with the vehicles ;) Every last road for dozens of kilometers would be clogged up as the route finding system tries to find ways to get there that aren't already jammed up.
Just a random unrelated thought: 10-20 years from now, autopilot and the like are going to be beloved by insurgent groups. One of today's preferred insurgent tactics is the VBIED, where they armour a truck up like a tank (at least from the front), load it with several tonnes of explosives, and drive it straight into enemy formations. They're very effective, even if just a small fraction of them make it through. Some groups in Syria are now experimenting with remote VBIEDs, using RF or wire communications to control the vehicle without the need to sacrifice a driver. But with autopilot? Just punch in the destination, disable / fake the driver sensors, and off it goes.
Wingus, Dingus! Listen up!
You don't even need an OS and the battery life is better. Just club someone with a sock full of batteries (don't even need to be LiPos). You don't even need to charge the batteries.
They should have called themselves Teflon, not Tesla.. Nothing seems stick to them. It's all the customer's fault.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
The thing that worries me is that pretty soon, you won't be able to buy any car that doesn't include a whole bunch of electronic remote communications, whether you want it or not, and regardless of whether you consider it a security and/or privacy risk.
Here in the UK insurers routinely demand that a recognised tracker device be installed in faster/higher-end vehicles as an anti-theft measure before they will provide cover. Moreover, I don't know myself where the tracker is installed in my own vehicle, because no-one except the person who actually did the installation does; apparently the people who do it won't even tell the dealers or allow anyone else in the room while they're working. I have some reservations about that already given the obvious privacy implications and the legal requirement to have insurance to use the car. But at least that is a separate system, operated by a private company whose contract is with me and whose reputation would be on the line if it came out they were activating the tracking for any reason other than my calling them and asking them to.
With modern cars that come with the likes of OnStar as standard, or with the new European eCall system that will be mandatory for all new cars sold in Europe within the next couple of years, you're talking about an electronic system that is intimately connected into the operational systems on the car and has remote communications capabilities. Given the notorious lack of security within a typical car's software environment, these systems seem potentially very dangerous to me, despite being well-intentioned and presumably being beneficial if you really are in a serious accident.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
You "start" an electrical car. ....)
The switched 12V power supply that is used to ENABLE the powertrain still has the traditionnal name "IGNITION", even if the car does not have an ignition at all ( Diesel, Electric.... ) or if the ignition signal is further gated (hybrid gasoline
aaaaaaa
Yes, I also don't get this one, it's moot.
aaaaaaa
I appreciate your smiley, this is actually a serious security issue. The trouble is, it's not even an insurgent on the far side of the world driving a remote controlled weapon that is the biggest concern. It's an insurgent on the far side of the world turning your own car into a remote controlled weapon while you and your family are driving home in it from a shopping trip, along with many other cars at the same time.
I disapprove of fear-mongering over terrorism as much as the next guy, but objectively, the reason 9/11 was so devastating was that it turned an everyday facility that many of us take for granted into a weapon, unexpectedly. And the reason the botnet that took down several major websites a little while back was so devastating was that it co-opted the insecure connected devices of numerous otherwise innocent third parties to do its dirty work. The parallels with what could happen with insecure remote communications and software control systems in modern cars are disturbing, and there have already been plenty of demonstrations showing how insecure many of these systems really are today.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I miss the days where a company would be considered a bad company if they blamed customers for problems that happened with something they created and sold as a feature.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
It will be behind the glove box, they always are to tap Into car data
Tesla has its part of the blame. Not for the car, but for the Android app. Probably outsourced it to a webdev firm.
It depends on the app, I suppose. Some car manufacturers actually thought through this - BMW ConnectedDrive will allow you to lock the doors from your phone without hassle, but the unlock feature requires a phone call where a friendly agent verifies your identity. The function isn't even in the application - it's just a button that dials their 1-800 number.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
Yeah, how dare Tesla not fix Android's flaws and horrible cross-application security model. What a bunch of scammers!
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
Indeed. The NHTSA would never approve of a situation where commands transmitted by smartphone or other data link override commands physically given from hardware inside the vehicle.
Wingus, Dingus! Listen up!
Bit of a biased article calling it specifically "Android malware", when the same malware exploiting the same security issue on Tesla's part (oauth as plaintext) on iOS would work the same way.
It's not Tesla's fault that Android is insecure. It is Tesla's fault that they encourage customers to use an app on a known-to-be-horribly-insecure platform to lock and unlock their car.
I am TheRaven on Soylent News
To use this one would have to specifically target the android phone of a specific Tesla owner.
If someone wants to steal a specifically single person's car there are vastly easier ways to do it. Such as, hold a gun to the person's head and demand they turn over the key.
None of this was done in the wild, making the title needlessly click baity.
I'm a good cook. I'm a fantastic eater. - Steven Brust
"Since Android was launched over seven years ago, all Android devices have
shared a common security model that provides every application with a secure,
isolated environment known as an application sandbox. Android was one of
the first operating systems to introduce the idea of sandboxing to both protect
applications from attacks and protect the device from applications. Sandboxing
is used for all applications on the device, including system-level applications. "
https://static.googleuserconte...
iOS has had its share of remote exploitable root access vulnerabilities over the years, sandboxing (which Android does too) can't stop you once you have root.
Thieves going after high end vehicles routinely carry GPS / GSM jammers to ensure the tracker either gets no position fix or won't be able to communicate with the mothership. The equipment isn't especially expensive or hard to come by. I wonder why insurers still demand them.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
So your thinking is that Tesla should up the price of all their cars by ~$1000 and include an iPhone with every car?
Just abandon Android as insecure?
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
If Tesla didn't feel they could get behind the security of Android then they shouldn't have made the app. Google's loss. Maybe they'll make Android more secure.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
I think it was Tesla's choice to do that, and they chose otherwise.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Tesla didn't have to make an Android app.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
My Android developer take on this same story:
It is Tesla's fault. Why?
They decide which target sdk and which min sdk version they support (compile sdk doesn't really matter for liability purposes). They should be aware of the consequences of supporting older versions. If they use a feature that is vulnerable in one of the versions they support, it's CLEARLY their fault ;-)
This reminds me of a question I once answered - someone wanted to store passwords on Android's SharedPreferences for "remember password" feature. Someone told them to use SharedPreferences. I replied stating SharedPreferences can be seen in cleartext if the an app is using root to poll the filesystem (SharedPreferences' defense is nothing more than storing them in filesystem encrypted files, which # simply bypasses). Whose fault is it that a phone is rooted/rootable or that the app escalated by itself? Doesn't matter. These are clear case of snowball growing, but in practice, if you're using a feature of an API for which you can see the source (because you can, it's AOSP...), you're always to blame for the dangers you put on your software. I learned that the soft way, and so did Tesla - they better prevent the hard way from happening with a quick fix. As they probably are storing the token in a SharedPref, the secure-preferences lib probably solves their problem or heavily mitigates attacks.
Right, the locked out a function from the users but not from the hackers: They were able to reverse engineer some of the software that we use for our telematics," said Dave Buchko , a BMW spokesman. "With that they were able to mimic the BMW server.â
BMW didn't even think to use https to access their cars lock and unlock during design. A quick search shows lots of issues with the BMW connected drive security.
I live in eastern Europe and we're way ahead of you guys on this one. When you want to get insurance for a reasonably new car the insurance guys disassemble and rewire your OBD2 ports in a pseudo-random manner. Then they wire you a OBD2 F2F adapter whose input is your scrambled OBD2 and the output is the standard working one. In short, your car's OBD2 doesn't work without the adapter, so as long as you don't leave your adapter in the car your port is unusable without rewiring it back to a working condition.
Now granted this is a bit of security through obscurity, but it means a thief can't easily plug a laptop in your CAN to hotwire your car. Sure, if the thief has the time to disassemble your OBD2 port and can rewire it back they can steal your car eventually. However, this turns a 30-second job into a 5-10 minute job that requires extra tools and know-how and for a lot of car thefts that's good enough as prevention.
What I'm saying is, there's no car on the market that won't run without fancy remote/multimedia functionality. I can bet that even if the automakers want to make a car like that it will have a hell of a time getting certified.
TL:DR; The extra functions can easily be scrambled or unplugged internally in a way that disables them completely.
Trying to prevent reverse engineering is pointless, all you can do is make things more difficult and in doing so, making your code more complicated and harder to debug or potentially unreliable.
The fact is if you access something from a compromised device then you run the risk of whatever you're accessing being compromised too.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
If I use a Samsung Galaxy Notes 7 to steal a Tesla, what happens ?!?
Use a Note 7 to steal a Tesla and crash it into the back of a Ford Pinto hatchback.
That should make a nice explosion visible from orbit.
Sig for hire.
Of course they will. In fact, eventually they'll mandate it. They'll want the police to be able to stop your car remotely. Of course eventually someone other than the police will use the same method, but "think of the children" or "terrorists!" will cause them to implement it anyway.
So let me see if I understand correctly, if you download and install malware on your Android device, you'll get hacked, just where is the technology angle?
Teslas are 13x less likely to be stolen than an average car according to Teslas are hard to steal.
The reasons are multifold. Starting the car and driving it off is the easy part. The few Teslas stolen to date have been largely due to what might be considered extreme negligence on the owners part - like leaving the doors open and the fob inside.
But is that negligence? The car is totally connected and obscenely trackable. Getting away with stealing a Tesla would mean disconnecting it forever and thus losing a lot of its value. For example, you could never get a free recharge. I wonder how many of those few cars stolen have been recovered. I'd bet the number is high.
So, you steal it for parts? Wrong! There is virtually no used parts market. Tesla owners tend to buy their parts new.
It seems that the best you could hope for is likely a very quick joyride.
My question is "why this article now"? It is very sensationalist. I'm not questioning the efforts of those who found and reported the attack route. But why widely disseminate it to the general public without noting that Teslas are amongst the least likely to be stolen cars in the world. Is this an attack piece?
Security 101
1. If you can do something remotely, so can someone else.
"Grab them by the pussy" -- President of the United States of America
I'm sorry to be the bearer of bad news, but vehicles with such vulnerabilities have already been compromised on public roads in at least one controversial demonstration. This is not a hypothetical threat. Vehicles vulnerable to this sort of attack are on the roads today, yet so far governments their regulators either don't understand the dangers or don't seem to be willing to act on them.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
"That" being what?
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Tesla could have only released the app on iPhone, or sold an iPhone with Tesla, no one is preventing them from doing that. They made the choice to release the app on Android so now they should stand by it.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
So you think that it's Tesla's fault that Android, the widest deployed smartphone OS is a POS security wise. Ohkaaayyy...
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
It's not their fault that Android is a security risk. You're putting words into my mouth.
Tesla can't control Android, but they can decide whether they put their app on Android or not. If Tesla is comfortable putting their name behind an Android app that can start cars, then obviously they don't think Android is the POS that you think it is. They wrote the app, they can accept the risk for it. Or, they could only publish on iPhone only and say, "We're sorry we did not feel Android was secure enough for an app that starts our cars."
It is about Tesla taking responsibility for their actions.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
I see many people blaming Tesla, but in my opinion, assuming the OS can keep a cookie secret is not a security mistake. The flaw is in the OS here.
If you don't want people putting words into your mouth you're going to have to start explaining how you a coherent position.
So now you're claiming that Tesla should prevent people from installing insecure applications on their Android smartphones? The Tesla app isn't insecure, The token it uses to communicate with cars can just be stolen by other bad intentioned apps, something that could happen just as well on iOS.
Tesla should pull it's Android app just because some people can't stop themselves from installing even free game they see because each and every one could potentially steal the token from their android app? And for you the fault lies with Tesla and not with Google nor with the insecure practices of the owners?!?
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
Is it called Edison?
some people are a "glass half empty" some are "glass half full" i'm a "there is something in the glass be happy" person
YES that's what I'm saying. I'm not saying Tesla should pull their app, I'm saying it is their choice whether they pull the app or not. If Android was not secure enough to host their app then they shouldn't have made it. You can use the car without the app, so buy and iPhone or suck it up; and I am a adamant Android user. Maybe you aren't familiar with programming but an app is only as secure as the OS it sits on. Tesla should have researched Android and knew what they were getting into. It seems like they just rush head long into everything and expect their customers to take the risk and blame. Anyway the app itself stored the tokens in plain text which was wrong, but I think it goes far beyond that.
On the other hand, I guess if a high tech company like Tesla feels Android is safe enough, then all the complaints about Android security are hot air. Nor will Google ever have any inventive to improve it.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
So you're one of those blame the victim guys. I'm mostly an iPhone guy but have had pro Androids since Blackberry died. I'm not a potential Tesla owner as they have 2 wheels too many & I don't see my company buying Tesla's before I retire in a decade or two for my company car.
That Android has a security problem is no revelation to me as it is one of the reasons I chose iPhones yet even with all that said, Tesla isn't to blame here.
If you want to push Google to improve Android's Security, stop blaming the victims & start voting with your wallet by abandoning Android. Oh but that would inconvenience you by making your personal choices mean something so you'll continue to blame others and continue funnelling money to Google so they have no reason too change.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
I'm not saying that there can't be vulnerabilities elsewhere in the chain, but at least they thought about having that function available on OS platforms and hardware that they have absolutely no control over, and have no remedy to fix exploits of when it's loaded onto thousands of phones with dozens of combinations of hardware / software. And, BMW does not offer remote start capabilities - the most you could do is unlock the doors. You would still need to deal with any ignition immobilizer in place once you are inside, though that has been dealt with through the OBD2 interface in the past.
Still, we're talking about now exploiting multiple vulnerabilities in various systems, as opposed to getting a user to download some piece of shit app and have their car start for you.
In your reply you basically just said "but they have some backend system not running on a phone, and not running a phone OS, and not running a phone application that was exploited in a completely different way to achieve a completely different result!" It's moving the goalposts, and mostly irrelevant to the topic at hand.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.