All Discussion re: Tesla Motors Website & Forums

rpo · Apr 25, 2015

And now teslamotors.com is being redirected again. I think Tesla is having issues keeping control of their DNS right now.

stopcrazypp · Apr 25, 2015

jdo said:
Can someone explain to us non-network types (okay, maybe just to me): if the problem is that the DNS servers are redirecting teslamotors.com to a bogus IP address, then why can't we just access the site by typing in the IP address directly?

You can, but no one does that nor do they memorize the IP address.

supratachophobia · Apr 25, 2015

rpo said:
The MyTesla site is being redirected to something starting with "isis.camp" as of right now. That's probably why the mobile app and VisibleTesla are not working.

Yeah @uselesslogin, if you weren't concerned before, you may start your concern now.

thegruf · Apr 25, 2015

getting into the press (inevitably). Look out for some quality and informed reporting coming up ...

http://www.bloomberg.com/news/artic...ed-on-twitter-media-relations-e-mail-accounts

sorka · Apr 25, 2015

The CPO site is also compromised. Since it just went live today and there was big press release about it, you can bet this is doing real damage to Tesla's market place. If I were prospective buyer who hadn't looked until today when the CPO site went live, I'd have serious doubts about this company.

heapmaster · Apr 25, 2015

They could have forged the SSL cert for tesla's site and access the data by just storing all data that is sent to the servers if the tesla app uses the AFNetwork library, see here: Critical SSL Vulnerability Leaves 25,000 iOS Apps Vulnerable to Hackers

CALGARYARSENAL · Apr 25, 2015

LOL. The fear! Talk about a buying opportunity.

jdo · Apr 25, 2015

stopcrazypp said:
You can, but no one does that nor do they memorize the IP address.

Understood, but if I type in the IP address right now, it says that Tesla Motors is offline. If the problem is just the DNS server, why would they take the site off-line?

randompersonx · Apr 25, 2015

tliving said:
Also if its just a DNS hack, how does that explain the twitter account hacks? It seems to have been more coordinated.

Taking over the domain would make it easy to reset the twitter password by requesting a password reset link to the relevant teslamotors.com email address.

markwj · Apr 25, 2015

This is a DNS hack. Looks like it has been fixed at the root (control back in Tesla's hands), but the global DNS caches still have the cracker's malicious records.

My recommendations:

1] Don't login to teslamotors.com. Don't login to the remote App. Don't enter any credentials into anything teslamotors.com related.
2] Turn off visible tesla (or anything that could provide your credentials automatically).
3] From what I can see, the crackers went after the main domain, not the vn.teslamotors.com sub-domain, but not entering App credentials still seems prudent at this time.
4] Sit back, relax, and wait for the dust to settle. If you've done #1 and #2, you don't need to worry.

wk057 · Apr 25, 2015

The actual website is behind a load balancer/proxy/cache. The proxy is trying to get the DNS for the hidden/internal version of the site (the actual server) and is getting the bad DNS version which doesn't have that host pointed anywhere.

stopcrazypp · Apr 25, 2015

jdo said:
Understood, but if I type in the IP address right now, it says that Tesla Motors is offline. If the problem is just the DNS server, why would they take the site off-line?

Last time I checked a couple hours ago, it was still showing the Tesla site. You are right that it is now showing the site is off for maintenance.

They may have taken it down to make sure the hackers didn't manage to get access to anything. Since the hackers were able to spoof email addresses for quite some time as a recipient (that's likely how they got into the Twitter accounts, by sending a password reset request where the reset link would go to their own server), it's unknown what other accounts they got into.

markwj · Apr 25, 2015

jdo said:
Understood, but if I type in the IP address right now, it says that Tesla Motors is offline. If the problem is just the DNS server, why would they take the site off-line?

Taking it offline is the prudent course of action. It allows them to:

1] Get a forensic snapshot.
2] Make sure that the website itself was not affected, before opening it back up to the public.

supratachophobia · Apr 25, 2015

randompersonx said:
Taking over the domain would make it easy to reset the twitter password by requesting a password reset link to the relevant teslamotors.com email address.

Bingo, hello new MX records. This is why you should consider extra long TTL's for established DNS records that are unlikely to change.

wk057 · Apr 25, 2015

markwj said:
This is a DNS hack. Looks like it has been fixed at the root (control back in Tesla's hands), but the global DNS caches still have the cracker's malicious records.

My recommendations:

1] Don't login to teslamotors.com. Don't login to the remote App. Don't enter any credentials into anything teslamotors.com related.
2] Turn off visible tesla (or anything that could provide your credentials automatically).
3] From what I can see, the crackers went after the main domain, not the vn.teslamotors.com sub-domain, but not entering App credentials still seems prudent at this time.
4] Sit back, relax, and wait for the dust to settle. If you've done #1 and #2, you don't need to worry.

The hackers added a wildcard record for *.teslamotors.com, so they took over all subdomains.

The hackers were not, as of this writing, running an SSL/HTTPS server (port 443) so login attempts wouldn't go anywhere anyway. The hackers shouldn't have a valid cert to pass for teslamotors.com for this anyway, and the app won't connect without a proper cert.

I think the biggest concern of mine is the catch-all email redirect they had in place for mail destined to *@teslamotors.com.

stopcrazypp · Apr 25, 2015

wk057 said:
I think the biggest concern of mine is the catch-all email redirect they had in place for mail destined to *@teslamotors.com.

That's the biggest issue I see right now too. There's a lot of stuff they can do with that kind of redirect.

jdo · Apr 25, 2015

stopcrazypp said:
Last time I checked a couple hours ago, it was still showing the Tesla site. You are right that it is now showing the site is off for maintenance.

They may have taken it down to make sure the hackers didn't manage to get access to anything. Since the hackers were able to spoof email addresses for quite some time as a recipient (that's likely how they got into the Twitter accounts, by sending a password reset request where the reset link would go to their own server), it's unknown what other accounts they got into.

markwj said:
Taking it offline is the prudent course of action. It allows them to:

1] Get a forensic snapshot.
2] Make sure that the website itself was not affected, before opening it back up to the public.

Makes sense now. Thanks.

gg_got_a_tesla · Apr 25, 2015

In all this, don't know why that poor kid in IL was targeted:

http://www.cnbc.com/id/102620200

It it was wantonly done, hopefully, the link to the perpetrators can quickly be established.

kglad99 · Apr 25, 2015

teslamotors.com site and tesla twitter feed problems don't both me.

but my 'visible tesla' app and my iphone model s app are not connecting to my car. is anyone else seeing that?

robapodaca · Apr 25, 2015

I am having issues with my Android app, trying to connect to my car... anyone else having issues? possibly related to the hack?

All Discussion re: Tesla Motors Website & Forums

Member

Well-Known Member

Active Member

Active Member

Well-Known Member

New Member

Member

Member

Member

Moderator, Asia Pacific

Senior Tinkerer

Well-Known Member

Moderator, Asia Pacific

Active Member

Senior Tinkerer

Well-Known Member

Member

Model S: VIN 65513, Model 3: VIN 1913

Member

Member

Similar threads