Whoa! Come on tesla!

[PoitNarf]

I’m sure most here wouldn’t be foolish enough to fall for some targeted spear phishing scam. However many regular people out in the public do fall for these sort of things all the time. I see this regularly at my job.

We’ve recently been the recipient of targeted scams that try to trick our users into buying gift cards. The scammer creates an email address on another email provider like gmail with a similar looking email address as a department head and will also create a legitimate looking signature at the end of the email. They start off emailing all of the addresses for that department or area that they were able to pull from the web and send an email similar to “are you around?”. The name on the email is the same as their department head, so anyone not being cautious enough to realize the address is from outside our email domain may start replying to the scammer. After a few back and forth emails the scammer will reply back with something like “I’m in an important meeting right now but need some gift cards right away to send to person X, could you please go to the store and buy $100 in gift cards and email me photos of the cards”. They also specifically instruct the victim to scratch off the back of the gift card for the security code and to send photos of the front and back of the cards. Some of you reading this are probably thinking to yourselves that no one is that dumb to fall for this. PLENTY OF PEOPLE ARE FOOLISH AND GULLIBLE ENOUGH TO FALL FOR THESE TYPE OF SCAMS!

We’ve had dozens (yes dozens) of users at my job that have fallen victim to these targeted gift card scams. Some end up being taken for several hundred dollars. My point here is that if the reward is significant enough a malicious person will figure out some social engineering method to get what they want. While I hope that Tesla never experiences any data breaches it’s not guaranteed that they never will. All it would take is a partial breach of a customer email database. A malicious party gets hold of a list of Tesla customer email addresses and then creates an authentic looking fake site mirroring the layout of tesla.com and then sends an email blast out. They can cross reference the breached email database they have for other known data breaches of other companies to get names and potentially addresses of their victims. Once they’ve tricked a few people to reveal their passwords to them they could use or sell this info.

Tesla needs to offer 2FA for their accounts. I’d even go as far to say that they should make 2FA required for all logins to the Tesla mobile app from any mobile device that has not previously logged into the Tesla account before.

 

[telos]

Tesla needs to offer 2FA for their accounts. I’d even go as far to say that they should make 2FA required for all logins to the Tesla mobile app from any mobile device that has not previously logged into the Tesla account before.

I agree that 2FA is needed for their accounts and it's basic security they should be adding. It will solve the leaked or weak password problem, but 2FA doesn't really solve the phishing problem.

The reason is, as soon as you type in your tesla credentials into my fake web page, I can immediately turn around and use those to attempt to log into tesla.com. When tesla.com challenges me for 2FA, I turn around and challenge you for 2FA. If you're dumb enough to give me your credentials in the first place, you're dumb enough to give me the 2FA pin too. At that point I present the 2FA pin to tesla.com, and I'm in.

 

[PoitNarf]

I agree that 2FA is needed for their accounts and it's basic security they should be adding. It will solve the leaked or weak password problem, but 2FA doesn't really solve the phishing problem.

The reason is, as soon as you type in your tesla credentials into my fake web page, I can immediately turn around and use those to attempt to log into tesla.com. When tesla.com challenges me for 2FA, I turn around and challenge you for 2FA. If you're dumb enough to give me your credentials in the first place, you're dumb enough to give me the 2FA pin too. At that point I present the 2FA pin to tesla.com, and I'm in.

Perhaps, but there’s plenty of different methods to offer some variant of 2FA that could avoid that problem. For example, say I’m logging into the Tesla mobile app from a new device for the first time. I think the easiest and most convenient 2FA solution would be for Tesla to call your phone number on file. When you answer the phone an automated message would say something like “we’ve detected a new mobile login to your Tesla account, press 1 to confirm”. I would press 1 on my phone because I know I’m currently trying to login. I can’t think of any way to man-in-the-middle attack that, although I’m no security expert.

At the absolute least Tesla could send a notification text or email to you whenever they see a new login from a device they don’t recognize. At least that would give someone a heads up about a potential breach of their account.

 

[Fernand]

The various e-mail scams are still working on many people.
There are lots of people falling for IRS phone calls.

But mobile apps add more and better ways to fool some more,

But OK, guys, things are perfectly manageable and all is well.

 

[C141medic]

Teslafi does allow you to generate your own token, but it requires some programming which is way above my pay scale.

API Tokens - TeslaFi.com

Or you can just use this:
Tesla Token by Bryan Bartow
‎Tesla Token

 

[Lanzer]

This is good information for those who are not savvy in network security. In a nutshell:

- Change your password often
- Use strong password manager such as LastPass to stop sharing password between sites
- Do not use public wifi on the road, especially when logging into Tesla or financial services (if you drive a tesla you probably have a data plan)

In reality withdraw your bank account if someone else have your password to your bank. Many phishing traps can defeat two factor authentication just as easy as grabbing your password and 2FA code at the same time, so staying vigilant is the only way to stay safe.

FIDO authentication is starting to be implemented and it should add a much needed level of security for login. Tesla can also disallow unrecognized smartphone or browsers from logging in without consent through phone/email. Hope to see these features in the future.

 

[Arif]

Main reason I am wary of using Teslafi or 3rd party apps requiring my Tesla account credentials....

Another option that Tesla could offer would be have a separate passwords - one for managing your account, and another one that allows the app to control just the driveability aspect of the vehicle.

For 3rd party applications looking to just get software version information from the car, manage remote functions like AC etc, the account password could then be given out.

 

[Chewy3]

Another reasons I VPN on ALL wifi connections, secure or not.

 

[SR22pilot]

The danger of a NOOB reading this thread is that he will think Teslas are easy to steal. A regular car with a key can have the lock picked. There are also ways to pull the lock lever and hot wire a car. Most cars with a remote are subject to an intercept attack. Tesla is too but the car can be tracked and Tesla has made that very difficult to turn off. Teslas are one of the least stolen cars and they have the highest recovery rate. In the US I think only two were never recovered and that was before the mobile access was password protected. Yes, they can be stolen. Your home can be broken into. The idea is to be more difficult than the people around you.

The password comments apply to a lot more dangerous things than your Tesla. So people know, the general rules (use upper and lover case and a special character) are generally crap as is the expiration of passwords. The guy who was responsible for these rules has said he is sorry. Changing passwords causes people to write them down which is a greater sin than an old password. As far as decryption, a long phrase with misspellings is the best password. Nothing beats a lot of characters. Using unique passwords for each site limits damage.

 

[dsvick]

The worst part of the video is that 2FA doesn't actually solve the problem.

If I can convince you to log into my wifi pineapple with your tesla credentials I can just man-in-the-middle you, and prompt you to type in the 2FA PIN, and then log straight into tesla.com when you type it into my fake login page.

1. You connect to my wifi pineapple.
2. I present faketesla.com asking for your usename and password.
3. As soon as you type them into my faketesla.com, my script turns around and uses your credentials to log into real tesla.com
4. Real tesla.com sends the 2FA PIN challenge to me, and sends a 2FA PIN to your phone (if using SMS 2FA).
5. I present a fake 2FA PIN challenge on faketesla.com, and wait for you to type in the 2FA PIN you received on your phone (if using SMS) or from your 2FA app.
6. I immediately send the 2FA PIN you gave me to the 2FA challenge from real tesla.com.

Presto I just logged in as you, despite 2FA. Now I can take over your car.

This only works for the initial connection to the fake wifi.
Once the person has done that and walked away from their car you need to do it all over again if they have pin to drive enabled. And when they get another 2FA pin sent to them while their sitting in starbucks they're either going to go running out to their car or simply ignore it.

 

[dsvick]

So people know, the general rules (use upper and lover case and a special character) are generally crap as is the expiration of passwords. The guy who was responsible for these rules has said he is sorry. Changing passwords causes people to write them down which is a greater sin than an old password. As far as decryption, a long phrase with misspellings is the best password. Nothing beats a lot of characters. Using unique passwords for each site limits damage.

There are a number of password managers out there that let you generate long, random passwords and store them securely for use on both mobile devices and browsers. This makes it fairly easy to be secure and not write them down. Of course you do need to put your trust into the password manager ....

 

[SR22pilot]

There are a number of password managers out there that let you generate long, random passwords and store them securely for use on both mobile devices and browsers. This makes it fairly easy to be secure and not write them down. Of course you do need to put your trust into the password manager ....

Agreed. I use 1Password. It is on all of my devices and synced. It's password is very long and hasn't been cracked when several programs were run against it. You could know my entire life history and that wouldn't help you figure it out. I bought 1Password for my girlfriend because she kept passwords in random small notebooks. However, 1Password has moved to a subscription model so there may be better options.

 

[Saghost]

This only works for the initial connection to the fake wifi.
Once the person has done that and walked away from their car you need to do it all over again if they have pin to drive enabled. And when they get another 2FA pin sent to them while their sitting in starbucks they're either going to go running out to their car or simply ignore it.

I'm not sure that's true. It seems to me like the result of the successful man in the middle here is that the hacker's computer has now been authenticated as a valid user by 2FA and issued a token, and he should then be able to do anything the app can do until the token expires...

On reflection, though, the 2FA comes up when you enter a new device only, right? So the fact that you got a 2FA request from your known phone when you went through the new Wi-Fi should be a red flag...

 

[dmurphy]

Agreed. I use 1Password. It is on all of my devices and synced. It's password is very long and hasn't been cracked when several programs were run against it. You could know my entire life history and that wouldn't help you figure it out. I bought 1Password for my girlfriend because she kept passwords in random small notebooks. However, 1Password has moved to a subscription model so there may be better options.

Going off-topic, but the 1Password "standalone" license is still very much available. It's what I use vs. the subscription model. In the app, when you launch, on the welcome screen, underneath the "Subscribe now" button - there's one for "Need a licence. We have those too". That'll get you a standalone license.

 

[MentalNomad]

Wrong. You WILL be fooled into entering your "good password"
into spoofed login screens, he just showed you how.

Nope. Those screens were probably generated when he click through on a bogus "your account is locked" email. The problem is clicking in through phishing emails, 99.9% of the time.

No, if you go to use any app, a fake site that
perfectly mimics the normal login will fool most
people, there's no way to know it's not legit
unless you're checking the IP address and deep
protocol of the source and you know what's
a legitimate protocol and source.

A site cannot perfectly mimic an app. A site shows up in the browser. The app runs directly on your phone. Want to be safe? Don't use links from emails. Instead, go to your app on your phone and start it yourself. This is internet safety 101 - never click unsolicited links in emails, ESPECIALLY those that say "security" and "important." (The only appropriate email links to use are those emails that are sent immediately after you request one from a site yourself.)

Presto I just logged in as you, despite 2FA. Now I can take over your car.

The only solution is being aware enough not to enter your tesla.com credentials into places where you should not do that.

This is exactly right. The strongest defense against phishing like this is not 2FA... it's simply doing things for yourself, instead of letting emails do it for you. Emails have been insecure and leading people into trouble for 30 years; it's time to get up to speed.

I agree that 2FA is needed for their accounts and it's basic security they should be adding. It will solve the leaked or weak password problem, but 2FA doesn't really solve the phishing problem.

That's right - it does not solve it at all. If you click an email link that takes you to a fake site, it will ask for your password... followed by your 2FA... and then the phisher is logged into your account. It can then grab authentications tokens, send out funds, or whatever else it wants, the same as if you had no 2FA.

If you're going to carelessly follow email phishing links, 2FA will not save you.

This is good information for those who are not savvy in network security. In a nutshell:

- Change your password often

Not anymore - the advice to change passwords is finally being rescinded broadly. Microsoft is even disabling the "force password change every ## days" default on their servers.

Changing passwords simply makes people less secure because:
1. It makes people forget passwords, leading to simpler passwords and more resets.
2. It makes people put passwords in unsafe places, because they forget them.
3. The act of changing the password is an attack opportunity (fake "need to reset" emails, etc.)

The consensus is that it doesn't actually help, and it does do harm.

You should only change a password if:
1. It was weak to begin with, or it was the same password used at other sites/apps. These should be changed before something goes wrong.
2. The site/app in question was compromised and passwords were leaked.

Password managers are definitely the way to go. 1password and LastPass are two good choices with a very workable "free or cheap tier." (I use & recommend LastPass, myself.)

 

[Joshan]

Very well said Metnal. This has zero to do with Tesla and is a problem on ANY computerized system. In truth it is far easier to steal and keep any OTHER can than a Tesla.

 

[Runt8]

It seems to me like Pin to Drive should be used as the second factor, and Tesla should make it more difficult to override (i.e., not tied directly to your Tesla account). If you forget your pin then you need to call Tesla or log into your account and provide some additional piece of information - a password you set up when first enabled the pin, details about your loan, etc.

 

[thaian207]

add finger print reader, iris scanner and voice recognition authentication

 

[Runebane]

2FA does help, as long as the would be thief is lazy, so it is better to offer it. The only thing is, people still think that 2FA means they're safe and they're not. It only stops the lazy.

 

[kengchang]

Layer 8 problem