Tesla Motors accounts are protected only by
simple passwords, making it easy for hackers to potentially track and
unlock cars, according to a security researcher.
Tesla Model S owners need to create an account on teslamotors.com
when they order their cars and the same account allows them to use an
iOS app to remotely unlock the car's doors, locate it, close and open
its roof, flash its lights or honk its horn.
Despite providing access to important car features, these
accounts are only protected by a password with low-complexity
requirements -- six characters long and at least one number and one
letter -- a security researcher named Nitesh Dhanjani said Friday in a blog post.
The Tesla Motors site also doesn't seem to have an account
lockout policy based on incorrect log-in attempts, which makes accounts
registered on the site susceptible to brute-force password guessing
attempts, Dhanjani said.
However, the brute-force attacks are just one potential threat.
Tesla accounts could also be targeted through phishing and malware or
could be compromised as a result of third-party password leaks if car
owners reuse their passwords on multiple sites, the researcher said. In
addition, if the email associated with a Tesla account is compromised,
an attacker could simply reset the account's password because there are
no other checks involved, like answering secret questions, he said.
The researcher also believes that in its current implementation,
the Tesla REST API (application programming interface) used by the
official iOS app to interact with the online service, can also pose a
security risk.
The API can be used by third-party apps that require users to log
in with their Tesla credentials, the researcher said. For example, one
app called Tesla for Glass, which lets users monitor and control their
cars through Google Glass, stores the user's credentials, he said.
This behavior is dangerous because if an intruder compromises the
app's infrastructure, he could collect Tesla account credentials and
abuse the remote car control functionality they enable, the researcher
said.
Dhanjani believes Tesla Motors should should do more to protect
accounts beyond using a static password and advises Tesla car owners to
take precautions against potential security risks until that happens.
"Given the serious nature of this topic, we know we can't attempt
to secure our vehicles the way we have attempted to secure our
workstations at home in the past by relying on static passwords and
trusted networks," Dhanjani said. "The implications to physical security
and privacy in this context have raised stakes to the next level."
"Our customers' security is our top priority, be that in
developing a car with the highest safety rating or doing everything we
can to protect them against online security breaches," Tesla Motors said
in an emailed statement. "We protect our products and systems against
vulnerabilities with our dedicated team of top-notch information
security professionals, and we continue to work with the community of
security researchers and actively encourage them to communicate with us
through our responsible reporting process."
"Automotive manufacturers though innovative in engineering can
often oversee the security aspects just because there was no need to
digitally safeguard cars in the past," said Bogdan Botezatu, a senior
e-threat analyst at security firm Bitdefender. "While it may be true
that the online account does not allow a potential attacker to control
the car's critical systems, it could allow somebody to physically locate
the car and unlock it."
Botezatu believes that Tesla accounts should require a second
authentication factor when users attempt to authenticate from new
devices or when their active sessions expire.
An increasing number of manufacturers allow users to remotely
control their devices through cloud-based services. Devices with such
functionality range from IP-based cameras to network-attached storage
devices and home automation sensors.
It's unlikely that manufacturers will take a secure approach to
designing so-called Internet-of-things devices anytime soon, Botezatu
said, pointing out that at the moment most engineering efforts focus on
functionality and battery performance.
No comments:
Post a Comment