Has your Tesla been hacked? Use Teslamate?

[wayner]

You may have seen a story in the last couple of weeks about a 19 year old German man who hacked into a bunch of Teslas. So it seems that he did it via vulnerabilities in Teslamate.

See this story on Medium: How I got access to 25+ Tesla’s around the world. By accident. And curiosity.

 

[Soul Surfer]

Hole guacamole! Quite the story!

 

[wayner]

If I am reading it correctly, it looks like some Teslamate users installed Teslamate and Grafana on servers exposed to the internet and they never changed the Grafana password from the default. This guy found this servers and was able to access the info in the Grafana databases. Not sure if they used cloud services like AWS or Azure or whether they had their own servers that were public.

 

[Tony_YYZ]

Sadly I believe this is not the first time this happened. Same issue as before, keeping their instances unsecured and exposed to the internet.

 

[rypalmer]

Doesn't seem Canada specific. But yeah guard your Tesla credentials carefully..

 

[wayner]

It isn't Canada specific, but some of the folks hacked were in Canada.

 

[Beerbaron105]

Optiwatt safe?

 

[Vawlkus]

Was a few different third party apps that used improperly secured tokens for authorization. Thankfully the kid pushed it to Tesla as a white hat for the big bounty.

 

[dearnshaw]

Well, that's interesting.

Today (Feb 17, 2022) I was trying to find where I could manually activate Homelink on the (new and idiotic) UI for my Model 3. As part of rooting around, I checked the list of keys....and lo and behold, I saw one I didn't recognize. It was named "Victoria", and because it starts with a "V", it was down at the bottom of the list, so I wouldn't have seen it if I hadn't scrolled down.

They key type was 'card' and it became activated around December last year, a time when the car pretty much stayed in the garage. Needless to say, it was quickly removed. But it does remind me to periodically check the list.

Might be an idea to check your own keys to make sure nobody has surreptitiously added one.

 

[bagsofcole]

So I messed with Teslamate but couldn't even get Groan to plot data, is I kinda gave up on it. How can I be sure I've secured my car? Teslamate has been removed from my Pi, and I never successfully aded it to the AWS server. I think I'm safe, no?