Recently a tv-programme showed how easy it is to steal cars with a Remote controled acces!
You just buy a little computer via internet!
You get close to the car you want to steal, you select make and model! 5 seconds later you open the door and the engine is started! No keys needed!
All cars are subject to it! From the most expensive to the cheapest!
Cars stolen this way are often used for thieves, banckrobbers, and drugtraffickers! (Was filmed in europe, and cameracrews accompagnied such a thief, at one moment even chased by police!)
A neighbours Mercedes E was stolen this way!
Luckily he has an alarm that stops the fuelpump after 4-5km, so 5 minutes later the police found his car in the middle of a steet! The thieves ran out of juice and had abandonned the car!
Last edited:
S-2000 Roadster
#1244
- Apr 10, 2009
- 702
- 41
How, exactly, does this work on cars that have no remote door locks or remote ignition?
Mark Petersen
Model S EU P71
If they have Bluetooth this is at least possible in theory. XM radio or other such wireless channels could also be vulnerable, though those are more challenging since they are one-way.
How does this work?
These channels allow a remote wireless connection into one system in the car. While this system is generally isolated from the rest of the car in most vehicles (not in the Model S though) it is in many cases somehow connected indirectly. For example, the Bluetooth system is connected into the audio system, which has some interaction with the car's user interface, which normally runs on a shared Car Area Network that interacts with more critical systems in the car.
Thus, if a vulnerability in the Bluetooth stack (there are often many, some of them well-known) allows the bad guys to create a connection and send some invalid inputs, there might be bugs in the audio or console system that threat these inputs as code (buffer overruns or similar bugs, these are very common in all sorts of computers, though they have started becoming less and less frequent on Windows at least) and that allow the bad guys to run their own code on the console systems. Once there, a hacker can inject streams of data into the shared Car Area Network. Many cars were designed assuming only the legitimate car software has access to this network, so they don't provide any protection once the bad guys are there. Thus, once the bad guy can run arbitrary code on one of the systems connected to the CAN they can do things such as disabling the brakes, opening the throttle or, in more software-based cars even control the steering and more. And at the very least they could open the car remotely and start the ignition.
Tesla being originated from a guy that really gets software I can imagine some significant precautions have been taken, but I would really love to know how much attention has been paid to software security and how formally has this been addressed (there are well-defined and publicly available software security processes that should be followed by anyone developing commercial or critical software).
I would expect that no attention whatsoever has been paid to software security in the model S. We have heard of no evidence that Tesla has made any serious attempts to provide any security, and I know that most software development companies don't try very hard, especially when they're rushed.
It's a risk I'm willing to live with. But don't have any illusions about Tesla. If they had designed a secure system, they would have advertised the hell out of it. They didn't.
(Edit: to be clear, the other carmakers are just as insecure.)
I think Elon Musk is aware of the fact that the vehicles he builds (Model S, Dragon Spacecraft) are high priority targets for hackers to gain remote control. I think that encryption levels were chosen with careful consideration on every level, be it key fob, charge port, 3G module, or wifi connection.
You just can't do security afterwards.
You just can't do security afterwards.
ElSupreme
Model S 03182
I haven't seen any advertising about the new MB CLS not flipping over at highway speeds. If they had designed a aerodynamically stable car, they would have advertised the hell out of it. They didn't. Obviously it means the CLS is likely to flip over at highway speeds.
Last edited by a moderator:
I work on encryption for a living. Encryption is a necessary condition, but not even close to being enough. In fact, encryption is a tiny part of the solution.
Raffy.Roma
Active Member
IMO static passwords are very easy for hackers to be unveiled. I don't know how the system works because I don't have the Model S but best thing would be to replace the static password with a dynamic password that can be got only by the owner thanks to a device in the hand of the owner (like it happens to protect bank accounts).
ecarfan
Well-Known Member
Yes you certainly must be correct because look at all the Teslas and other late model cars that are being stolen by the hundreds every day without having to use any physical force to get inside the car since it is so simple even a 12 year old hacker can do it. It's amazing that we can even get insurance companies to sell us policies since cars are so easy to steal. Apparently the insurance companies are run by idiots who are happy to lose money on every policy they issue to Tesla owners.
Oh wait, I have yet to read about or hear of on this forum any Tesla being stolen without the thief having the car's key fob in their possession. But how can that be since Telsa has done nothing to ensure software security? What a puzzle this is...
Similar threads
