Hackers Able To Control Tesla S Systems From Twelve Miles Away

from the welcome-to-the-new-normal dept

Over the last few years, we’ve well documented the abysmal security in the internet of things space. And while refrigerators that leak your Gmail credentials are certainly problematic, the rise in exploitable vehicle network security is exponentially more worrying. Reports emerge almost monthly detailing how easy it is for hackers to bypass vehicle security, allowing them to at best fiddle with in-car systems like air conditioning, and at worst take total control of a compromised vehicle. It’s particularly problematic given these exploits may take years to identify and patch.

Enter Tesla, which, while indisputably more flexible in terms of technology, finds itself no less vulnerable to being embarrassed. Reports this week emerged that Chinese white hat hackers discovered a vulnerability in the Tesla S series that allowed an intruder to interfere with the car?s brakes, door locks, dashboard computer screen and other electronically controlled systems in the vehicle. In a video, the hackers demonstrated how they were able to target the vehicle’s controller area network, or CAN bus, from up to twelve miles away:

Fortunately in this instance, the attack required a fairly strict set of circumstances, including fooling the car’s owner into first connecting the vehicle to a malicious hotspot — while the car’s internet browser was in use. Also, unlike some vulnerabilities, which have taken traditional automakers up to five years to patch in the past, the researchers said in a blog post that Tesla was quick to update the car’s firmware and fix the vulnerability:

“Keen Security Lab appreciates the proactive attitude and efforts of Tesla Security Team, leading by Chris Evans, on responding our vulnerability report and taking actions to fix the issues efficiently. Keen Security Lab is coordinating with Tesla on issue fixing to ensure the driving safety of Tesla users.”

That said, this isn’t the first time that hackers have highlighted vulnerabilities in Tesla vehicles. A group of hackers earlier this year demonstrated how they were able to use about $100,000 in radio equipment to fool the Tesla S model’s autopilot feature into perceiving obstacles that technically didn’t exist, or obscuring obstacles the car would normally avoid:

“A group of researchers at the University of South Carolina, China?s Zhejiang University and the Chinese security firm Qihoo 360 says it?s done just that. In a series of tests they plan to detail in a talk later this week at the Defcon hacker conference, they found that they could use off-the-shelf radio-, sound- and light-emitting tools to deceive Tesla?s autopilot sensors, in some cases causing the car?s computers to perceive an object where none existed, and in others to miss a real object in the Tesla?s path.”

Comforting! Obviously these are just the vulnerabilities we know of, and there’s likely a very hot zero day market for car vulnerabilities, with state actors willing to pay top dollar for exploits allowing the staging of “accidents” local yokel investigators aren’t likely to ferret out as malicious. Alongside the even worse security in many “smart” (read: wholly idiotic) internet of things appliances, we’ve been happily introducing tens of thousands of new network attack vectors annually. As we rush unpatched toward the driverless future of tomorrow, what could possibly go wrong?

Filed Under: , ,
Companies: tesla

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Hackers Able To Control Tesla S Systems From Twelve Miles Away”

Subscribe: RSS Leave a comment
Anonymous Coward says:

And this is another reason of why we need strong encryption and protection for our devices.

For those of us who value our privacy, there is no need of it.

But for those who would give away their privacy in exchange of a shred of security, to make that clear that not only they won’t get that extra bit of security.

But that they will be way less secure than without encrypted and protected systems.

Anonymous Coward says:

Re: Re:


source: Work in IT. Security is only a problem if you get fucking hacked, or you can show and article of someone else being hacked in that way. If someone else is NOT hacked in that exact way then it is non-sequitur.

Idea’s like JEA or Security Risk Mitigation are just fucking lost on management. Entire teams would bitch about losing access to a system they never touch except during build/decom processes and that is just fucking SOP.

No one accepts the idea that they should just not fucking have access until they NEED IT!

Jeremy Lyman (profile) says:

Hey there Elmer!

So, a browser exploit was immediately patched? Because all the cars are Internet connected? This is exactly how it’s supposed to work. That’s the benefit to having devices connected; which you constantly poop FUD on. Programs will have bugs, computers will have exploits. That shouldn’t keep us from using them and fixing them when necessary.

Anonymous Coward says:

Re: Re: Re: Hey there Elmer!

“Companies and developers should be cautious and thorough with features”

Should be, but they will not. Profits are the highest priority (only priority for some) while the should have things are shelved based upon how much the corp might be sued for.

People do not need their motor vehicles connected to the internet. Some people would prefer to not have this “feature” and do not like being forced to pay for it. This does not make them horse ‘n buggy people.

Anonymous Coward says:

Re: Hey there Elmer!

So let me get this straight. The FDA gets to regulate food and drugs and restrict my freedoms often in ways that can be very detrimental to me and often with the intent of protecting pharmaceutical profits (ie: by not allowing me to freely experiment with various treatments, it’s my health, if I have a health problem it should be my choice to decide what treatments I wish to try and in what dosages without them getting in the way) yet it’s perfectly OK for companies to sell cars that may have life threatening bugs without the required oversight to properly discourage the sale of cars with such bugs and to penalize them when bugs do show up and cause injury?

Our priorities are backwards. The only consistent theme that the government seems to be focused on is protecting corporate profits.

orbitalinsertion (profile) says:

Re: Hey there Elmer!

Oh yay, the call of the FUD. Except innovating stupid isn’t innovation. When some researchers who just happen to have an interest and funding, doing the vendor a favor, and the vendor actually responds with a fix, it’s mostly cool. But the real patch is: Don’t make critical systems with such a wide attack surface in the first place. It’s stupid and unnecessary. It is merely trendy. The sad thing is, if IoT morons would simply make things functional without being sloppy and adding their thousands of holes so they can harvest data off you, a lot of this wouldn’t happen, but most “innovations” are not really useful in the first place. The really sad this is, people doing things like auto manufacturers have a huge pool of people and information to draw on who have already successfully executed things like, oh, fly by wire and other critical systems for 20-30 years, depending on what you consider relatable to contemporary automobiles.

Anonymous Coward says:

Re: Hey there Elmer!

So, a browser exploit was immediately patched? … This is exactly how it’s supposed to work.

Except for the part where the web browser had control over the brakes. That’s not some minor detail, it’s indicative of a serious design flaw.

The lack of information regarding the patch is worrying. Did Tesla just fix a browser bug, as browser vendors do every few weeks? Or did they actually make sure the web browser is isolated such that no bug like this could ever happen again?

Anonymous Coward says:

Re: Re:

Or rather, what can be done with those vulnerabilities.

Answering also to Jeremy Lyman: the difference between a browser exploit in a computer and the same thing happening in a car is that the car can be turned into a weapon instantly.

You don’t need AKs or tons of bombs to kill 150 people: you just need a vulnerability in place, the proper stuff to exploit it and a highway full of cars at 120 Km/h (75 mph).

Moreover if you grab the proper car, namely a gas truck or something full of chemicals and other shit, and make an accident happen.

Browser vulnerabilities fuck up your stuff: car vulnerabilities can kill you.

I’d rather want the companies be EXTREMELY careful with what they do, and without backdoors that can be exploited.

PT (profile) says:

A-B Test Required

“…they could use off-the-shelf radio-, sound- and light-emitting tools to deceive Tesla’s autopilot sensors, in some cases causing the car’s computers to perceive an object where none existed, and in others to miss a real object in the Tesla’s path.”

And this would not be a problem for a human driver? Nobody ever has an accident or runs a red light because the sun on the horizon blinds them? Humans don’t jump when a truck blasts off its air horn behind them?

Anonymous Coward says:

Re: A-B Test Required

“…they could use off-the-shelf radio-, sound- and light-emitting tools to deceive Tesla’s autopilot sensors…

And this would not be a problem for a human driver?

Much of it wouldn’t be. For example, humans can’t perceive radio waves, infrared/ultraviolet light, or sounds above 20 kHz. Someone with a giant flashing strobe light aimed out their windshield would be noticed quickly. But if you had an infrared light that caused the car in front of you to pull to the side of the road, it would probably be dismissed as a glitch. Or it might be difficult to prove anything at least.

What if you could cause a crash by transmitting a radio wave or invisible light beam from a distant balcony? Nobody would suspect anything the first one or two times.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...