Security Evaluation of the Tesla Model S 93
An anonymous reader writes: "Nitesh Dhanjani has written a paper outlining the security mechanisms surrounding the Tesla Model S, as well as its shortcomings, titled 'Cursory Evaluation of the Tesla Model S: We Can't Protect Our Cars Like We Protect Our Workstations.' Dhanjani says users are required to set up an account secured by a six-character password when they order the car. This password is used to unlock a mobile phone app and to gain access to the user's online Tesla account. The freely available mobile app can locate and unlock the car remotely, as well as control and monitor other functions.
The password is vulnerable to several kinds of attacks similar to those used to gain access to a computer or online account. An attacker might guess the password via a Tesla website, which Dhanjani says does not restrict the number of incorrect login attempts. Dhanjani said there is also evidence that Tesla support staff can unlock cars remotely, leaving car owners vulnerable to attackers impersonating them, and raising questions about the apparent power of such employees to locate and unlock any car with or without the owner's knowledge or permission. In his paper, Dhanjani also describes the issue of Tesla's REST APIs being used by third parties without Tesla's permission, causing Tesla owners' credentials to be sent to those third parties, who could misuse the information to locate and unlock cars."
The password is vulnerable to several kinds of attacks similar to those used to gain access to a computer or online account. An attacker might guess the password via a Tesla website, which Dhanjani says does not restrict the number of incorrect login attempts. Dhanjani said there is also evidence that Tesla support staff can unlock cars remotely, leaving car owners vulnerable to attackers impersonating them, and raising questions about the apparent power of such employees to locate and unlock any car with or without the owner's knowledge or permission. In his paper, Dhanjani also describes the issue of Tesla's REST APIs being used by third parties without Tesla's permission, causing Tesla owners' credentials to be sent to those third parties, who could misuse the information to locate and unlock cars."
In other news (Score:2)
...trusted sources reported today that if a Tesla vehicle is dropped from orbit, the impact would be devastating. The NTSB is looking into this, and Fox News reports that Obama is responsible. Scientists confirm using actual math that the outcome is all but inevitable.
[camera shows stock shots of meteor crater in Arizona]
Tesla has not responded to our requests to comment, except to say that SpaceX cargo capacity is a privileged corporate information.
In financial news, Aluminium foil prices are up.
Re: (Score:3)
Is there a market for used or stolen Tesla cars or parts?
It wouldn't 100% shock me (though it'd have to be an export job, 'notable and uncommon', 'aggressively interacts with the vendor', and 'stolen' are not attributes that work well together); but it's probably not on the top of the list of cars that flip or chop easily.
On the other hand, its materials/recycle value is probably above average for vehicles of its size.
Re: (Score:2)
Is there a market for used or stolen Tesla cars or parts?
It wouldn't 100% shock me (though it'd have to be an export job, 'notable and uncommon', 'aggressively interacts with the vendor', and 'stolen' are not attributes that work well together); but it's probably not on the top of the list of cars that flip or chop easily.
On the other hand, its materials/recycle value is probably above average for vehicles of its size.
I know /. is very US centric, but in Europe driving a stolen car over a border is trivial and a Tesla will fetch a good price even in Eastern Europe.
Re: (Score:2)
Either way, once you get 'outside the country' whether literally (US) or figuratively(t
Re: (Score:1)
"Is there a market for used or stolen Tesla cars or parts?"
Not very likely. Even the radio is dangerous for the ears, since the volume goes up to 11.
http://en.wikipedia.org/wiki/U... [wikipedia.org]
unlock the fire within (Score:2)
Seen This One Before (Score:5, Interesting)
They had taken advantage of remote tech to disable the vehicle and engage the horn from a keyboard... in case of nonpayment for the former and sometimes aiding location efforts for the latter.
Poor chap was so disgruntled he killed vehicles and blew horns for most of a weekend before they deduced the antagonist. I am sure there are some repercussions for this kind of adventure, but hell, if there's even a chance you'll have a grandchild, do you want this story in your arsenal?
Re:[citation needed]:Rocky's 5th best line (Score:3)
It goes without saying we'll both lie to the customer.
We'll just plain be honest with each other.
Re: (Score:1)
Re:"Vulnerable"? (Score:5, Insightful)
Re: (Score:2)
Re: "Vulnerable"? (Score:3)
My wife's family owns my towns only Locksmith company.
I spent some time working there, and let me tell you the best tool for breaking into cars is the correct tool for that vehicle. We had toolboxes of roughly 15 tools for various vehicles. Knowing which tool to use and how to use it is a skill I think everyone should learn.
My favourite was the slimjim. I even made my own because I wasn't fond of the one included in the kit. Its so versatile.
As an aside: We worked with CAA (Canadian version of AAA) and once
Re: (Score:1)
As an aside: We worked with CAA (Canadian version of AAA) and once every month or so we'd get a fax to unlock a vehicle (usually a Ford for some reason) who's keyless entry fob's battery had died. We would arrive and they are holding their key in their hand, pressing the button to unlock it and they are getting frustrated the vehicle isn't unlocking. I would calmly ask to see their key, walk up to the door and stick it in the door's keyway and turn it. The look on their face was always priceless. I even had one lady confess she didn't know that was even possible.
But if the car has an alarm system and it's active, this doesn't help much. If I unlock my car with a physical key, there's a three-step process I need to do in order to disable the alarm and engine kill. If your owners didn't realize their keys would work, what's the likelihood they'd then remember everything else required before driving away?
Re: (Score:2)
But if the car has an alarm system and it's active, this doesn't help much. If I unlock my car with a physical key, there's a three-step process I need to do in order to disable the alarm and engine kill. If your owners didn't realize their keys would work, what's the likelihood they'd then remember everything else required before driving away?
The alarm will also go off if I open it with a tool to bypass the lock... It's not my responsibility to know how to turn the alarm off. The point I was trying to make was these people did not know they could unlock their car, and gain access to their belongings, without their keyfob.
Of the three calls I handled in this in the situation I described, they were factory keys with the remote unlock buttons on the key itself.
I even had one case, where the passenger window was rolled down half way, allowing me to
OK, Tesla not qualified to do automatic driving (Score:5, Informative)
How to steal car:
...
1. Guess username and password.
2. Log in to "https://portal.vn.teslamotors.com".
3. Send GET to "https://portal.vn.teslamotors.com/vehicles" to get list of vehicle IDs for that owner.
4. Send GET to "https://portal.vn.teslamotors.com/vehicles/{id}/command/drive_state" to get vehicle latitude and longitude.
5. Send GET to "https://portal.vn.teslamotors/vehicles//vehicles/{id}/command/door_unlock" to unlock doors.
6. Get in car and plug laptop into onboard Ethernet, where car internals are exposed, unencrypted.
And those guys think they're going to do automatic driving. Right.
Re: (Score:3)
How to *actually* steal car: (Score:5, Insightful)
1: Hold gun, knife or pipewrench in "I'm going to use it" position, threaten owner, drive away with car, possibly with the owner as well.
Tools required: One. (may substitute inexpensive gun replica if low budget operation)
Number of attempts required for success: One
Technical knowhow required: Zero.
Additional opportunities inherent in operation: Ransom money, rape subject, opportunistic beatings, petty theft, direct access to bank accounts.
Re: (Score:2)
Reality. At the end of the day, what will the insurance company accept as sufficient security so as to replace the vehicle upon claim of theft, nothing more and nothing less. As for the balance of easy usability vs number of features vs security implementation, with a modern electric computerised vehicle that might best be left to a consultation between the sales consultant and the end user, with features not wished by the end user disabled and or other features set up.
Re: (Score:3, Informative)
Reality. At the end of the day, what will the insurance company accept as sufficient security...
No, the security only has to be sufficient enough to blame you [wired.com] for the theft.
the balance of easy usability vs number of features vs security implementation, with a modern electric computerised vehicle that might best be left to a consultation between the sales consultant and the end user
The salesman and customer are the least informed for making security tradeoffs, and the complications of having multiple security arrangements across a fleet of supported vehicle isn't worth the extra headache for the manufacturer.
The "balance" of this situation should not lie in the boneheaded territory of elementary security mistakes... if you're going to have a remotely accessible API, hire programmers who understand securi
Re: (Score:1)
Except this'll get the police searching for you within minutes. Unlocking it remotely will probably give you hours before it's noticed, during which you have time to remove/disable the tracker, hide the car and change the plates, maybe even the colour. And with zero risk of setting the alarm off, which is its advantage over just breaking into any car on the street. Plus it lets you target expensive new cars since it even tells you where they are.
Re: (Score:2)
Why would the police search until the driver is reported missing? Which might not happen for days, depending on the driver's social connections, but certainly won't happen for hours, by which time the car has either been disassembled or packed into a shipping container anyway.
Re: (Score:2)
It was relevant to the thread. My point was it's a little ridiculous to worry about these complex electronic paths to stealing a car. Any thug can steal your car with little to no effort; practically speaking, all they need is the desire to do it and the opportunity.
I'll grant you that criminals are generally not the brightest people, but I don't think that predisposes them to do something via a significantly more complex method. The focus is on the wrong thing here.
Re: (Score:2)
Ah, someone who doesn't understand the USA. Steal a car (and particularly a Tesla), you've *already* committed a felony; having done so and gotten caught as you suggest, you're going to jail and then most likely prison, not one, but *two* varieties of "assrape-land" as you put it, and when you get out, you will be unemployable, consequently if you want any of the supposedly "good" things in life, significantly profitable enterprises will be limited to things like, you guessed it: stealing cars, burglary, de
Re: (Score:2)
No question, the optimum time is just as they approach the car. Once inside, or in motion, things become much more difficult.
obligatory xkcd (Score:1)
Re: Here it comes... (Score:2)
Silicon is not made from oil.
Re: (Score:2)
I believe the GP was referring to the plastic portions of laptops, which are largely synthesized from oil and natural gas, not silicon.
Re: Here it comes... (Score:2)
Plastic is not computer-specific, and is not required at all for a computer. Some popular laptops are even made of aluminium.
Re: (Score:2)
Please cite a source for any laptop which does not contain plastic.
Re: (Score:2)
and is not required at all for a computer
You must have missed my earlier reply. As the GGP comment contained the excerpt "like your computer", I'm still eagerly awaiting a citation regarding a computer which contains no plastic components, presumably one available for purchase under the implicit assumption that you are in possession of such a machine. I'm looking forward to the opportunity to purchase this wonderful device for my own use, so please don't keep me waiting too long.
not limiting attempts (Score:5, Interesting)
I've never seen a login delay enforced in the wild, but it pretty much neuters any brute force attack. At least , if they are attacking the server, it does. If they get ahold of the encrypted passwords, then they can brute force it at their whim.
Re:not limiting attempts (Score:4, Insightful)
On a completely random note, I think the amount of time to do this attack, even with the current setup, would make it nonrealistic. Someone above listed the steps to break into a Tesla using this vulnerability (how accurate they were, I don't really know - or care for that matter). There's one big factor that is being overlooked, however. With relatively few Tesla cars on the road right now (I don't know the exact numbers at the moment, but compared to all other cars on the road, I think we can agree that "relatively few" is a safe estimate), this particular attack isn't one that could be done with the "normal" way that I imagine stealing a car goes:
"Hey that's a nice car...lets steal it!"
For this attack to work, it would have to be done one of two ways:
1. Break into "random" Tesla accounts until you found one in your area
2. Exploit this attack to steal the car
OR
1. Find a Tesla parked somewhere.
2. Somehow figure out that car's account
3. Break into that account
4. Use exploit to steal car
Basically, the time it takes to break into one Tesla account is irrelevant. The goal is to break into the RIGHT Tesla account, which I imagine, unless you already knew a lot about the owner of a particular car, would take a lot longer than this 69 year number being thrown around for breaking into a single Tesla account by brute force.
Re: not limiting attempts (Score:1)
Break into any account, find position of car, go there, steal car.
brute force attack takes a minute or so (Score:2)
If you have a botnet, you can have tens of thousands of computers do a log on attempt almost simultaneously. It'd take just a few days at full speed (tesla would notice) and a few weeks at moderate speed to get a significant amount of Tesla car accounts cracked. Once you have that, you can use the account details to find the exact location of those cars. At those numbers, the chance of finding one near you is actually high enough for thieves to be able to drive to one near by so they can unlock it and get
Re: (Score:3)
Then, in a well designed system, you'd have 1000, 10000 or 100000 responses that all say "It has not yet been one minute since the last failed login to this account. Your login attempt was not accepted."
Re: (Score:2)
Re: (Score:1)
With a 6 digit password composed of numbers and letters, it would take 69 years to guarantee breaking a password...
guarantee. Statistically.
On the other hand, most users don't use random strings for passwords.
Option? (Score:4, Interesting)
Is it even possible to buy a Tesla without all that online, password-protected, cellphone-enabled stuff?
Re: (Score:2)
Re: (Score:3)
Re:I had issue with this day one when we took deli (Score:5, Informative)
Service can unlock (Score:5, Informative)
I know service can unlock your car remotely, since I have one (model S) and they did it for me.
The interesting thing is Elon made his fortune at PayPal. You think he'd know better.
Re: (Score:2)
Given that Tesla, Inc. knows the position of all its cars at all times, what is the benefit of stealing one? If you then drive it for any length of time, the police will track it to your location and arrest you. OTOH, you could try to sell it for parts, but I doubt the Tesla parts market is large enough to do that anonymously; most likely anyone interested in buying said parts would know they were stolen and would report you to the police.
Is it THAT bad? (Score:2)
How does one steal these cars? Is anybody even trying and succeeding at stealing them yet?
Ok, so you take the quite likely insured car... How do you get away? Drive like mad for... 300 miles then wait for many many hours to recharge? (NO, instant battery swap requires ID, quickcharger stations talk to the computer probably ID the car too, slow charging is the probably the only secure way and that takes TIME.) Naturally all this is after you rip out wherever their cell modem's antennae is.
They don't need m
Re: (Score:2)
If only he'd spent more time sitting around absorbing the endless stream of "what could possibly go wrong..." posts on slashdot, instead of building an empire.
Re: (Score:2)
Questions: (Score:2)
* Can the owner switch off the remote control/access to their car ?
* Can the owner switch off the remote control/access to their car by Tesla as well as the owner ?
* 6 character password. Is that the minimum length or the length it must be (Ie can't set a longer one) ?
* It mentions an iPhone app. What if I don't have (or want) an iPhone ?
* What cars made by companies other than Tesla have similar systems ?
Re:Questions: (Score:4, Informative)
* Can the owner switch off the remote control/access to their car ?
Yes.
* Can the owner switch off the remote control/access to their car by Tesla as well as the owner ?
No.
* 6 character password. Is that the minimum length or the length it must be (Ie can't set a longer one) ?
Minimum. The password can also contain special character.
* It mentions an iPhone app. What if I don't have (or want) an iPhone ?
There's an official android app. I think there's an unofficial winphone app too. There's an unoffical chrome plugin and stand-alone JAVA app.
* What cars made by companies other than Tesla have similar systems ?
No one has anything as comprehensive. Closest is probably on-star.
The guy describes gives some bad advice (Score:2)
His major mistake is not comparing the electronic security to current security.
He complains about static, short complexity passwords, but does not recognize that most of the time longer, more complex passwords decrease security.
Many current car locks can be picked by by a guy with a bump key. The electronic security he lists is in fact far more secure than the standard key lock/ignition. More importantly, cars have side windo