Forums

We can't protect our cars like we can our workstations

We can't protect our cars like we can our workstations

Some security problems are outlined here; http://www.dhanjani.com/blog/2014/03/curosry-evaluation-of-the-tesla-mod...

Not to hard for Tesla to fix. But it should be done soon.

ERon | 29. März 2014

The article was misleading and provocative. Nobody can steal your car. At worst they can access information in the car, big whoop. They can flash the lights and change charging setup (that could be trouble), but you'd easily see and correct that.

The likelihood there will be a problem is small, though a longer password or a call back algorithm (longer connect time here) would be better. IMO.

JPPTM | 29. März 2014

...how about changing your password to something longer and more complicated..6 characters, really???

NKYTA | 29. März 2014

@JPPTM, that was my takeaway as well. The article makes it out that everyone has a six character password.

Not me!! (think 19 chars or larger) and I change mine more than monthly.

The article was wasted bytes unless it helps to educate folks to use a password vault, random password generation and to understand that, yes, you need to change your passwords.

Webcrawler | 29. März 2014

More FUD...period...

Brian H | 29. März 2014

Cindy I II III | 30. März 2014

Brian H, are u suggesting that a really long password that start with something easy for human to remember and end with something hard for human to guess will help fend off both machines and other humans?

ziggy | 30. März 2014

A pass phrase is the way to go as Brian H points out.
Harder for machines to crack simply because it is longer but easier for humans to remember.

But also Tesla does need to fix the web site. Allowing guesses from the same IP over and over is an easy way to crack easy passwords that people might use.

I don't want anyone opening my car and stealing stuff out of it.

P Sands | 30. März 2014

Tesla is itself provocative and it is no surprise that innovation generates provocative discussions. Open lively debate is healthy.

The article is educational and does point out potential vulnerabilities as most Tesla owners take a big technical plunge with a touch screen controlled car.

Although personally not technically geeky, the password, direct and remote access, and third party app issues would appear to be something that Tesla and their owners can easily address with education and updates.

Looking forward to many more provocative questions.

rsigman | 30. März 2014

While I have never used this procedure, the best idea I have seen is to take the first letter of each word of a lengthy enough easy to remember phrase or book title or movie (e.g. Harry Potter and the Prisoner of Azkaban would be hpatpoa).

Nuts4MS | 30. März 2014

Most of those are common to all websites and people who not able to recognize any type of phishing or malware, in short the same folks who believe that their PC has been locked by the FBI and requires a $200 payment via a green dot card to unlock.

PBEndo | 30. März 2014

You need an email address and a password to login to the car.

Using your email address as your displayed username on the forum gives a hacker half of the info they need. In addition, it gets you on spam lists.

Since email addresses can be found from so many other sources. I have considered changing my Tesla email to a unique address that I never use elsewhere.

PBEndo | 30. März 2014

I should clarify - the remote apps require the email address.
The website will take email address or username.

Car t man | 30. März 2014

It is about time users (not just the company) start to first worry, and as result, begin to care about security. Better before than after it becomes
painfully obvious that it is and will be a serious issue at some point.

Thinking that hiring one person somehow magically means safety is naive. Much like posting private info online and not realizing that affluent consumers, posting lots of preferences online, is something that doesn't attract social engineering and exploit professionals.

Don't whine if someone posts about an issue. Pay attention and be proactive. Protect the car as best you can, while expecting same from Tesla.

PBEndo | 30. März 2014

Is Tesla's security any worse than OnStar's? I have never had OnStar so I am unfamiliar with their security and capabilities.

omarsultan.ca.us | 30. März 2014

Its a reasonable article and the conclusions are fair--the attack vectors he pointed out are legit and there are things that Tesla owners should be aware off such as having strong passwords and being cautious about sharing credentials with 3rd parties.

I think the biggest issue right now is the unsecured ethernet port--that is kinda sloppy.

That being said, I have faith in Kristin setting them right.

O

Captain_Zap | 30. März 2014

I never turn on remote access. I assume I have nothing to worry about. I don't have the app because I have no real use for it.

I don't have a need to preheat, flash the lights or honk the horn. I really don't want my spouse watch me drive around aimlessly.

I turned on the remote access on one time when I dropped it off at a detail shop. That's it. Only my spouse has the app and he just uses it as a toy and watched it while it sat there at the detail shop.

I have no interest at all in any apps that may come along later that are not under Tesla's complete control either. That seems like a big risk for abuses.

We did try to use the app for keeping the AC on in the car for the dog but we learned that the AC times out when you use the app. Instead, we just turn on the AC manually when we leave the car and it will stay on until we get back.

AmpedRealtor | 30. März 2014

@ CZ,

How do you get the AC to stay on when you leave the car? This would be invaluable to me in my business, but only know how to do that using the app. It's kind of clunky this way.

Captain_Zap | 30. März 2014

@AR

I put the car in Neutral and set the emergency brake on the touch screen. You will want to turn off your automatic headlights and your automatic wipers or you might find them on when you come back to your car after dark or if it started to rain.

After the emergency brake is set, I get out and lock the car with the fob.

I haven't needed to do it for a couple months so you might want to test it and make sure that it will still operate in the same fashion after the most recent update.

AoneOne | 30. März 2014

From an IT standpoint, I think the article is quite reasonable. They neither exaggerated nor downplayed the obvious security issues with the car. Of course, someone could use the article as FUD, but the article itself wasn't inflammatory.

I'd like to see a third-party credential system so Visible Tesla never sees my login. That's the issue that bothers me the most, even though I have reasonable trust in that app and it's developer.

In any case, I have a suggestion for unique emails: Gmail (and probably others) ignore a '+' (plus sign) and any following characters in an email address. So, instead of using @gmail.com, you could use +@gmail.com. This allows you to generate multiple, different, email addresses

AoneOne | 30. März 2014

Sorry, HTML broke my suggestions...try this...

...instead of using myname@gmail.com, use myname+randomstuff@gmail.com...

omarsultan.ca.us | 30. März 2014

BTW, the XKCD comic that Brian H posted is a good start, but computing power is so cheap, even that is not infallible. Because the words (horse, battery, etc) are in the dictionary, its still vulnerable to a brute force dictionary attack. To add another layer of protection, use words not in the dictionary (nonsense words or intentionally misspelled) and use unconventional capitalization, for example, capitalize a letter in the middle or at the end of the word.

For example: correkthorsbatterY

Red Sage ca us | 30. März 2014

Random worD mIXEd or inTerLeaved wItH Hexadecimal:

attitude + ad6be7 = Aatdt6ibteu7dE

...or Binary:

helion + 42 = HelioN + 101010 = H1e0li0o1N0

Gadfly | 01. April 2014

Eron

If an attacker can gain root access to the car they could certainly start/stop/accelerate. No idea if the current security holes allow "root" or not but they probably make it easier to do so. With a car that can do OTA updates like ours, it damn well better be very secure. These basic security issues suggest that the car may not yet be as well protected against hackers as it should. I agree that it's not a huge worry, but it is something I'm sure the engineers are addressing.

And why is on star security relevant in any way to this discussion? That's like excusing Obama as a bad president because Bush was a bad president. No relevance whatsoever.

omarsultan.ca.us | 01. April 2014

The drivetrain systems are separate from the system that controls the secondary systems, display etc, which is why you can reboot the systems while driving without loss of control. So no, gaining "root" access to the latter will not give you access to the former, as the former use embedded SW not a full-fledged OS.

O

vincent.himpe | 01. April 2014

that article is bogus. it is MINIMUM 6 character but can be much longer.

try hacking a password like :

ThisIsMyCarThePasswordLetsMeDriveIt.

simply pick a sentence:

MyFavoriteVacationDestinationIsTahitiItAlsoLetsMeDriveMyCar

good luck with your attrack vector...

renwo S alset | 01. April 2014

In the real world, what is the reward to a hacker if he got into my S? I don't keep my bank account or classified correspondence on my car and I doubt anyone has a motive to take control of my car remotely. Like many security issues, what is the threat?

omarsultan.ca.us | 01. April 2014

@vincent

Even you very long passphrase will fall to a brute force attack as long as you use words in the dictionary (see this enlightening/scary article for details: http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-ou...). Now will someone actually expend the effort is a different story. Probably not, but using the car as an attack vector to get into the Tesla servers (say be compromising or spoofing the OpenVPN connection) would be more worthwhile.

There are a couple of simple things Tesla could do like enable two-factor authentication and certificates. They could also implement an temporary lockout after x number of failed attempts to protect against brute force attempts.

Being a networking geek, I would also like to see them lock-down the unprotected Ethernet port.

O

David70 | 01. April 2014

Do people really use words from the dictionary?

PBEndo | 01. April 2014

@Go Long TSLA
"If an attacker can gain root access to the car they could certainly start/stop/accelerate."

Do you know if the same system that allows remote access also has the capability to control acceleration? If you don't know this, than it is not a certainty.

PBEndo | 01. April 2014

@Go Long Tesla
"And why is on star security relevant in any way to this discussion? "

It seems pretty obvious, but I'll go ahead and explain it in case you were napping.

The headlines make it sound like Tesla is unique in this security issue.

PBEndo | 01. April 2014

@Go Long TSLA

...and OnStar has been in service since 1996, with millions of users. If their security is similar and they have had no major security breaches, it is relevant.

I agree, both Obama and Bush were bad presidents.