SoylentNews is people
SoylentNews
Keen Security Lab senior researchers Sen Nie, Ling Liu, and Wen Lu, along with director Samuel Lv, demonstrated the hacks against a Tesla Model S P85 and 75D and say their efforts will work on multiple Tesla models.
The Shanghai, China-based hacking firm has withheld details of the world-first zero day attacks and privately disclosed the flaws to Tesla.
The firm worked on the attack for several months, eventually gaining access to the motor that moves the driver's seat, turning on indicators, opening the car's sunroof and activating window wipers.
The Chinese should not make Iron Man angry...
According to Ars Technica :
Tesla has already issued an over-the-air firmware patch to fix the situation.
Previous hacks of Tesla vehicles have required physical access to the car. The Keen attack exploited a bug in Tesla's Web browser, which required the vehicle to be connected to a malicious Wi-Fi hotspot. This allowed the attackers to stage a "man-in-the-middle" attack, according to researchers. In a statement on the vulnerability, a Tesla spokesman said, "our realistic estimate is that the risk to our customers was very low, but this did not stop us from responding quickly." After Keen brought the vulnerability to Bugcrowd, the company managing Tesla's bug bounty program, it took just 10 days for Tesla to generate a fix.
(Score: 2) by goodie on Wednesday September 21 2016, @01:21PM
The Keen attack exploited a bug in Tesla's Web browser
Why, why, why? It's a car right? Why is there a browser that ends being connected to the car's inner functioning? I'd think that you could do what airplanes do: separate navigation from entertainment, no? It's always the frigging browser it seems with security issues...
(Score: 0) by Anonymous Coward on Wednesday September 21 2016, @01:34PM
One network in the car is cheaper than two?
Since Tesla does complete software updates over the internet (Wi-Fi or cell network), even if there is more than one network in the car, they all have to be linked together to be upgradable. This could be a weakness of the Tesla sales model (very few Tesla stores), with some customers living hundreds of miles from a dealer. Contrast with a Chevy dealer in every little town, software updates can be installed at the dealer, by wire.
(Score: 0) by Anonymous Coward on Wednesday September 21 2016, @01:50PM
(Score: 0) by Anonymous Coward on Wednesday September 21 2016, @02:15PM
Forget nitrogen, try helium. It will make your tire and hence your car lighter, no?
(Score: -1, Troll) by Anonymous Coward on Wednesday September 21 2016, @02:24PM
That's OK, your sister works at the car dealer and if she was out of a job, then you would have to support her...in addition to the kid in the basement.
(Score: 5, Insightful) by Arik on Wednesday September 21 2016, @02:40PM
The critical systems should be absolutely separated from the internet-connected entertainment system, no if ands or buts. They should have absolutely no interaction of any kind. The critical systems should be programmed carefully in something like ADA which is actually designed for this sort of task, so that a constant stream of updates are not needed. Any change to those systems should require physical access and the system should be tamper-evident.
But no, it's always cheaper to say sorry after and slap patches on than to do it right from the start. At least as long as the legal system lets you get away with it.
If laughter is the best medicine, who are the best doctors?
(Score: 0) by Anonymous Coward on Thursday September 22 2016, @07:09AM
Unless the car comes with a built in 3D-printer allowing you to download fresh brake pads, you'll have to get it serviced just like the Chevy.
With a correctly airgapped system, you wouldn't need to download security updates every week.