Drones, Teslas, exploits and Oh My!

[WereCatf]

Summary

 

Researchers late last year demonstrated that they could remotely hack a Tesla and do things like e.g. open doors, change seat positions, controlling the AC and modify steering and acceleration modes.

 

Quotes

Quote

The attack, dubbed TBONE, involves exploitation of two vulnerabilities affecting ConnMan, an internet connection manager for embedded devices. An attacker can exploit these flaws to take full control of the infotainment system of a Tesla without any user interaction.

 

A hacker who exploits the vulnerabilities can perform any task that a regular user could from the infotainment system. That includes opening doors, changing seat positions, playing music, controlling the air conditioning, and modifying steering and acceleration modes. However, the researchers explained, “This attack does not yield drive control of the car though.”

 

They showed how an attacker could use a drone to launch an attack via Wi-Fi to hack a parked car and open its doors from a distance of up to 100 meters (roughly 300 feet). They claimed the exploit worked against Tesla S, 3, X and Y models.

 

My thoughts

Before people start yelling about Tesla being used for splashy headlines again, this attack was developed for PWN2OWN 2020, of which Tesla was a part of. Also, Tesla isn't the important part here, but rather how easy it was to gain access to a modern "smart" car entirely remotely; it's not just possible, but rather likely that cars from other manufacturers are similarly affected and that's a rather scary thought. Tesla has stopped using ConnMan, but who knows how many vulnerabilities lie in its replacement?

 

What the article in the sources doesn't mention is that this hack relies on the fact that Teslas were (are?) configured to automatically connect to any WiFI AP with the SSID of "Tesla Service" with a hardcoded passkey (see the PDF-link) that can be simply extracted from the firmware by naughty parties. That's a really, really stupid design-decision, even if it was made for the sakes of convenience.

 

Sources

https://www.securityweek.com/tesla-car-hacked-remotely-drone-zero-click-exploit

https://kunnamon.io/tbone/tbone-v1.0-redacted.pdf

[Moonzy]

as things gets more computerized, i expect more of this to happen

 

assassination is just one button away

[Guest]

13 minutes ago, WereCatf said:

ConnMan

Well that was just waiting to be exploited lol.

[Guest willies leg]

I'm sure Tesla will fix it in another free OTA update. They're pretty good, and they know they're a software and cloud company that just happens to have a computer on wheels.

[WereCatf]

3 minutes ago, willies leg said:

I'm sure Tesla will fix it in another free OTA update.

I did mention that they have since stopped using ConnMan.

4 minutes ago, willies leg said:

Meh, another anti-Tesla story being pushed by the media.

Reporting on a practical attack is automatically "anti-Tesla" just because the attack was for a Tesla? How would one report the news without it being "anti-Tesla", then? Should they avoid mentioning which manufacturer was in question just to avoid offending your sensibilities?

 

No, that's a childish take on this. Reporting on actual facts is exactly what news should be doing.

[WolframaticAlpha]

50 minutes ago, Moonzy said:

assassination is just one button away

God, I just love technology!/s

[RejZoR]

1 hour ago, willies leg said:

I'm sure Tesla will fix it in another free OTA update. They're pretty good, and they know they're a software and cloud company that just happens to have a computer on wheels.

Computers generally like to crash a lot...

[HenrySalayne]

We reached a point to think about a mandatory "emergency stop" button. A hardware switch on the dash-board disconnecting everything but the brakes.

 

[Guest willies leg]

2 hours ago, WereCatf said:

I did mention that they have since stopped using ConnMan.

Reporting on a practical attack is automatically "anti-Tesla" just because the attack was for a Tesla? How would one report the news without it being "anti-Tesla", then? Should they avoid mentioning which manufacturer was in question just to avoid offending your sensibilities?

 

No, that's a childish take on this. Reporting on actual facts is exactly what news should be doing.

 

It's really click-bait "Tesla Car Hacked Remotely From Drone via Zero-Click Exploit"

 

What does a drone have to do with anything? And zero click? Where's the Tesla clicker? Visions of hordes of drones attacking Teslas while their drivers frantically try to click the "close button" so funny! I guess if I'm stupid or anti-tesla I'd click on that link pronto! Maybe share it with all my anti-tesla friends! Oh, right, that was the goal wasn't it?

 

I'd be more understanding if, for example, they compared Tesla's hard-coded credentials with anybody's phone with "saved networks" where most people have "guest/guest" remembered. Now that's a story with something actionable!

 

[wanderingfool2]

40 minutes ago, willies leg said:

 

It's really click-bait "Tesla Car Hacked Remotely From Drone via Zero-Click Exploit"

 

What does a drone have to do with anything? And zero click? Where's the Tesla clicker? Visions of hordes of drones attacking Teslas while their drivers frantically try to click the "close button" so funny! I guess if I'm stupid or anti-tesla I'd click on that link pronto! Maybe share it with all my anti-tesla friends! Oh, right, that was the goal wasn't it?

 

I'd be more understanding if, for example, they compared Tesla's hard-coded credentials with anybody's phone with "saved networks" where most people have "guest/guest" remembered. Now that's a story with something actionable!

 

It's not anti-Tesla.  Click-baity yes, but not really anti-Tesla.  There are key distinctions between anti-Tesla and creating extra flair via click-bait (and admittedly the researchers did do their POC with a drone apparently)...it likely would have just been easier putting it in a backpack.  After all, if you read through the white paper you would realize that there are some valid concerns.

 

Tesla really shouldn't be using a predetermined password to connect to a wifi (or at least have it so there are additional verification checks done).  The fact is, that was used as a gateway for this type of attack.

 

Honestly, after reading the article, this is one of the least anti-Tesla articles I've seen in recent times.  I mean even in their bolded first line they say "and possibly other cars"

 

This does go to show though, the more important systems are connected the more security you really need around them

[Kilrah]

5 hours ago, willies leg said:

What does a drone have to do with anything?

The fact that you can take the drone, fly it out 1km away and have it do the attack without having to be anywhere near or being detectable, potentially while the car is driving? Certainly more serious than if you have to be next to, or even have physical access to the car.

[da na]

I clicked on this because the title of the thread sounded kinda badass.

Honestly the prospect of more things like this happening is terrifying though. You wake up one day and your car's gone. "Oh Rachael, someone hacked the car again"

[Guest willies leg]

2 hours ago, Kilrah said:

The fact that you can take the drone, fly it out 1km away and have it do the attack without having to be anywhere near or being detectable, potentially while the car is driving? Certainly more serious than if you have to be next to, or even have physical access to the car.

 

Why do you need a drone to successfully attack the car? I can probably connect to your phone with a remembered guest/guest wifi login too, don't need a drone for that either.

 

[BuckGup]

This issue isn't a new thing at all, it's been happening since 2015. 

https://www.pcmag.com/news/hackers-remotely-hijack-a-jeep-crash-it-into-a-ditch

[Quackers101]

just emp the thing and watch it crash, oh

[divito]

Only stuff available through the infotainment? Kudos I guess? 

[ARikozuM]

Who else came in thinking ohmibod was hacked and is disappointed that this isn't the case? 

[Zodiark1593]

1 hour ago, willies leg said:

 

Why do you need a drone to successfully attack the car? I can probably connect to your phone with a remembered guest/guest wifi login too, don't need a drone for that either.

 

From an attacker’s perspective, It is actually preferable (not mandatory) to use a drone as a proxy. Having distance from the target makes it much more difficult for officials to track down, as security cameras and witnesses are rendered ineffective. 

[Taf the Ghost]

18 hours ago, Moonzy said:

as things gets more computerized, i expect more of this to happen

 

assassination is just one button away

Pesky journalist have had weird accidents for a long time. Though I believe there's been two very weird cases with Teslas and connected people that seemed rather odd. 

 

Though what'll keep you up at night is that Over the Air Attacks can work on Planes.

[Taf the Ghost]

5 hours ago, Zodiark1593 said:

From an attacker’s perspective, It is actually preferable (not mandatory) to use a drone as a proxy. Having distance from the target makes it much more difficult for officials to track down, as security cameras and witnesses are rendered ineffective. 

Micro drones that basically act as a Wifi Bridge. With a proper dish and drone, the attacker would be miles away, execute the attack, land the drone somewhere to retrieve it. Dispose of the drone and laptops in another location and no one will ever have a clue what happened. The "accident" is chalked up to driver error with maybe the occasional lawsuit about faulty acceleration pedals or something.

 

A couple of years ago, there was a presentation withdrawn before getting to a Blackhat conference where a guy basically use something like a Raspberry Pi and two wifi setups to make a little box to act as a bridge to any coffee shop wifi. You could use a couple of these, even, to daisy-chain the attack vector. The ability to re-route traffic is a very powerful tool.

[Drama Lama]

11 hours ago, wat3rmelon_man2 said:

I clicked on this because the title of the thread sounded kinda badass.

Honestly the prospect of more things like this happening is terrifying though. You wake up one day and your car's gone. "Oh Rachael, someone hacked the car again"

It just drove away 

[Guest willies leg]

10 hours ago, Zodiark1593 said:

From an attacker’s perspective, It is actually preferable (not mandatory) to use a drone as a proxy. Having distance from the target makes it much more difficult for officials to track down, as security cameras and witnesses are rendered ineffective. 

Not any of the drones I've seen. They're loud and can only run for like 20 minutes or so. Can't use them when it's windy, raining or snowing. I'd say a laptop in a car or backpack would be a better plan. But that doesn't sound as fun as a drone!

[WereCatf]

24 minutes ago, willies leg said:

They're loud

Doesn't matter. You can't tell whose drone you see in the air or what it's doing, plus you'll have a very hard time following it once it flies away.

26 minutes ago, willies leg said:

can only run for like 20 minutes or so

There are plenty that can run longer than that. Besides which, they fly really damn fast and the hack itself takes literally seconds, so even 20 minutes is plenty.

26 minutes ago, willies leg said:

Can't use them when it's windy, raining or snowing

Maybe not the cheapest ones.

[wanderingfool2]

2 hours ago, willies leg said:

Not any of the drones I've seen. They're loud and can only run for like 20 minutes or so. Can't use them when it's windy, raining or snowing. I'd say a laptop in a car or backpack would be a better plan. But that doesn't sound as fun as a drone!

It's mostly click-baity (by the researchers as well to maybe get more notoriety potentially).  The other consideration could be that a drone can have a larger coverage in a larger parking lot.  Cars parked tightly together can potentially create quite the signal loss to the wifi signal (had an access point that would occasionally have a larger vehicle park infront of it in the parking garage, and the usability of the signal dropped to only 3/4 the distance...this is just one vehicle)

[Quackers101]

drone could just hide a place that is high, then start to fly away.

can I put 100 drones as a mini spaceX starlink system over a small area?