You can install our site as a web app on your iOS device by utilizing the Add to Home Screen feature in Safari. Please see this thread for more details on this.
Note: This feature may not be available in some browsers.
KEENLAB @keen_lab
@0xcharlie @nudehaberdasher p2o=pwn2own for the 140-char limit. We plan to publish the details after the fix is pushed to Tesla owners.
8:00 PM - 19 Sep 2016
1 retweet 6 likes
I don't think I saw brake lights when they remotely activated the brakes. Brake lights only came on after the car had come to a stop.
I wonder if a fix might have been linked to the update that rolled out the last couple days as "bugfixes."
I also heard the car go into park when it came to a stop.
Ah. I was hoping to finally be able to gain root access to my car so that I can enable the web browser, but looks like I have a classic chicken-and-egg problem here.the hack would only work through the web browser when connected to a malicious wifi network
EDIT: according to this article, the fix for these issues has already been deployed (2.36.31 software), and that the hack would only work through the web browser when connected to a malicious wifi network. Pretty rare, but still good Tesla fixed it.
Car hackers demonstrate wireless attack on Tesla Model S
The web browser isn't the only thing that's disabled here. Keyfob-controlled Summon is another, more useful, example.It's not worth hacking the car to get the webbrowser, it really isn't that useful anyway.
WiFi stack is not considered a part of the browser. If there was a WiFi stack exploit, very good chance it could be exploited when anything else is communicating (Nav, VPN, etc). Btw, there are more ways to exploit either without making the car connect to a rouge access point, I just don't want to post ideas for people who may not be responsible researchers ;-)Wouldn't that depend on whether the browser or the wifi stack had the vulnerability? If the browser had the vulnerability then you would be correct and the article is wrong.
If the bug is in the wifi stack but is only exploitable through traffic from the browser (since it doesn't go over the VPN) then you need the wifi connection.
...
Where is the negligence in that?
The hack was to the MCU, which has a button to apply the parking brake. Regular braking wouldn't have been accessible to the MCU (I don't think).I also heard the car go into park when it came to a stop. It was as if the car sensed unwanted movement and stopped itself. Same thing as if you were to get out of the car with it in drive. Wonder if it would work at speed.