ng-nz logo
Story image

Tesla owners beware! Security researchers find major holes - firmware updates critical

01 Aug 2017

Researchers at Tencent’s Keen Security Lab have published more details major security holes in Tesla’s firmware, which attackers could use as a full attack chain to control vehicles.

The company posted the details of the vulnerabilities in a blog last week, which found that the attack chain could implement arbitrary CAN BUS and ECUs remote controls. In other words, attackers could control the vehicles remotely.

In 2016, Keen Lab conducted multiple tests on Tesla Model S vehicles, which found that attackers could potentially control vehicles in both park and drive move. Researchers said at the time that it was the first case they knew of that used CAN BUS compromises to achieve remote controls.

Last month, Tesla CEO Elon Musk was quoted at a US National Governors Association meeting as saying that cybersecurity in Tesla vehicles is a major priority.

He said that a fleet-wide hack could be a potential reality, but manufacturers have to make that impossible. He suggests that override authority is the way to do that.

In September last year, Tesla also implemented a security process called ‘code signing’, which was designed to conduct integrity checks of firmware. Keen Labs was able to bypass the code signing.

Musk also said that there are some sub-systems such as braking and powertrains that have multiple levels of encryption, which means attackers can’t gain control of those systems.

Keen Lab researchers say they followed ’responsible disclosure’ processes so that Tesla had time to verify and confirm all bugs in the report.

Researchers also found a number of zero-days in different vehicle modules. While those vulnerabilities haven’t been properly documented yet, they are working with Tesla and other manufacturers to assign CVE numbers. CVE numbers are given to every vulnerability found.

Tesla says that most of the affected vehicles have now been patched and updated via firmware-over-the-air (FOTA).

Researchers are urging Tesla owners to check that their vehicle’s firmware has updated to version 8.1 (17.26.0) or later. If not, update systems immediately.

Tesla also encourages security researchers to report security vulnerabilities.

“Tesla values the work done by security researchers in improving the security of our products and service offerings. We are committed to working with this community to verify, reproduce, and respond to legitimate reported vulnerabilities. We encourage the community to participate in our responsible reporting process,” the company says on its website.

Here’s how Keen Labs researchers managed to take control of a Tesla vehicle.

Story image
Game review: Borderlands Legendary Collection on Nintendo Switch
I was pleasantly surprised when I opened Borderlands (2009) and the highly stylised art direction and animation didn’t seem like it was from the same year that Barack Obama first took office.More
Story image
Full reveal: LEGO shares a glimpse of the full Super Mario range
“Sixteen LEGO Super Mario sets have been introduced and I am really looking forward to seeing how people’s play expands with these and the unique Power-Up Packs,” says Nintendo game producer and executive officer Takashi Tezuka. More
Story image
Hands-on review: Twelve South HiRise Wireless 
The HiRise wireless charging stand is both elegant and useful. It is a two in one that would be a great addition to any desk or nightstand.More
Story image
Almost 40% of the Earth's population will be gamers by 2023
There will be 3 billion gamers on the planet by the time 2023 comes along, and the gaming market will suprass US$200 billion worldwide during the same year, according to the latest data from Newzoo.More
Story image
Advertisers modelling GFC behaviour as Facebook ad costs tank and Google Ads rise 
"Marketers are looking to prove return on investment by spending on what is measurable and targeting customers who are already searching and already in the click and buy cycle."More
Story image
Dropbox adds new features for people working from home
“We’re working quickly to provide new features to help people stay better organised in all aspects of their lives so they can focus on what really matters - like health and family.”More