Hacking vehicle computer systems and networks is achievable using the tools, techniques, and exploits hackers already have at their disposal.
Tesla’s Model S and Model X are no exception. Even though they have been touted as the world’s most secure vehicle they still have a number of security vulnerabilities. Not only are the vehicle’s susceptible but their networks are too.
Hackers were able to access Tesla’s secured VPN network. They found VPN encryption keys stored in an SD card on a Model S and were able to leverage those keys to login on Tesla’s network. The hackers were allowed to continue access the network without discovery. The authentication to the network was all that was required for cars to identify themselves to Tesla’s VPN network.
The hackers were allowed to discover other internal networks, devices, and servers. Typically hackers will run port scans and use other techniques to discover exploitable systems on the network. They accessed servers and file systems. They downloaded and decompiled code meant for the cars. This allowed them to potentially discover even more exploits in the vehicles’ operating system.
Discovery of additional unencrypted files with unsecured passwords on the VPN network further enabled hackers to access Tesla’s WiFi network at their service centers. The cars are automatically designed to connect to WiFi at service center locations for software updates and diagnostics. This allowed hackers to access even more systems to download tools and software designed to control the vehicle’s functions. One such tool can even cut power to a Tesla while being operated.
Just because an endpoint can authenticate to a network, does not mean the endpoint should always be trusted. Hackers can sniff around or cause damage. Trojan horses, viruses, and other software exploits can be uploaded to vehicles and then in turn delivered to vehicle manufacture networks via their own secured VPN connection.
Tesla isn’t the only car company susceptible to hackers. Jeep recently had some of its vehicle’s remotely hacked through the Internet connected cell phone link. Once hackers gained access to Jeep’s Internet capable infotainment system, they were allowed hack into subsystems to alter all types of settings in the vehicle.
Air conditioning, stereo, LED displays, power steering systems, transmission, and braking system were all hacker controlled. Even more dangerous hacks could disable the engine, enable windshield wipers and fluid, and control other potentially distracting features which could impair the driver’s ability to safely control their vehicle.
The same types of dangerous controls proven on Jeep vehicles could potentially be achieved on Tesla and many other vehicles as well. This highlights the need for comprehensive security for the vehicle manufacturers. Not just to increase the security on the cars themselves, but especially on the networks and systems these vehicles connect to. The entire ecosystem of networks used to maintain, diagnose , update software, and provide other functions on vehicle’s must be watched over and analyzed for malicious activity.
