Telsa hack alert
You have heard about the businesses hit by the ransomware attack on Friday and their demand for $50 Million. What you have not heard is that, presumably on the basis of threats made by “Revil,” the NSA has urgently reached out to a few parties to urge them to plug security holes. One of them was Tesla’s Elon Musk, and the others were the IT departments of Samsung, LG, and Motorola, who are individually responsible for rollouts of security patches for their phones.
Here is what I believe is happening: At some point in the last two months, Samsung, LG, and Motorola were compromised and were made to send out faulty security patches that bestowed an outside entity with full control of any phone installing them. This is yet another example of a ‘trickle-down’ attack where devices that are dependent upon updates from a centralized server may be compromised En masse by breaching the security of only a few networks. As of yet, the IT departments of the companies that I’ve mentioned have not responded to our urgent messages, except to state that their security measures are adequate and that they’ll take the NSA’s alert under advisement.
Based upon snippets of conversations around the doughnut cart and water cooler that I’ve been able to hobble together, here is what I think is going on: The entity known as “Revil” has compromised virtually all Android devices in the United States and Europe. Their intention may be to hijack the Internet-connected Tesla automobiles in a way that perhaps the company was not expecting. Back in 2009, the NSA concluded that hackers were responsible for a series of incidents in which Toyota automobiles accelerated out of control due to a vulnerability that allowed an anti-theft system meant to disable cars and slowly bring them to a stop to be used by an unauthorized third party to disable the brakes and cause the car to accelerate.
In this case, the weak-point in security is Tesla’s infotainment system, which can be interfaced with using Bluetooth. The Revil attack seems to be based upon using drivers’ phones to take control of Teslas through the Bluetooth functionality of the phones. The malicious code now loaded into all Android devices receiving security updates from one of the aforementioned companies enables Revil to turn on Bluetooth functionality on the phone without the owner’s knowledge and run an automated brute force attack to form a connection with any Tesla automobile within range. Once this connection is established, a separate chunk of malicious code designed to work with the latest Tesla software configuration, is uploaded into the car through the infotainment system, where it takes root in the primary computer responsible for all of the functions of the car, including acceleration, braking, gear-shifting, and steering.
By breaching servers at Samsung, LG, and Motorola, Revil may well be able to ultimately affect tens of thousands of simultaneous high-speed automobile accidents that could involve not only Tesla drivers, but others on the road as well. It is alarming to me that we have not heard back from any of these companies with a plan for purging Android devices of the malicious code and that consumers are not receiving a direct alert.
We were assured a number of weeks ago that this criminal gang was dealt with after breach of the Colonial Pipeline but clearly this was not the case. The American people have the right to know about this danger, a philosophy that my superiors do not seem to share.
This is the only whistleblowing on a chan I've seen that seems believable. But I still have a few questions:
Why haven't android updaters rolled out any patches for this? It seems like something that they'd want to fix.
What makes you think that the goal of this would be to cause car accidents?
Do you know anything about where in the software distributed the connections are made? I might do some searching if I can get an idea of where to look.
****
It is not a known vulnerability, but it piggybacked in on a patch between a month ago and two months ago, if it exists.
We only found out about it because of logged communications recovered from servers we breached in the process of looking for those responsible for the Colonial hack. The logged emails alluded to an upcoming event in substantial enough detail to take it seriously, and enough to at least know how they intended to pull this off. I do not know which module of the uncompiled security update was affected, but I know it's a timeframe of less than 60 days. Somewhere in that period, they must have made a subtle change to files "to be compiled" on the LG/Samsung/Moto servers, something that wouldn't be noticed necessarily.
Causing car accidents is the least damage someone could do with this approach. They may also be able to turn automobiles 'on' on a timer wherever they happen to be and engage a rapid discharge of the battery, particularly from a overcharged state (which could be permitted if safety limits on charging are disengaged by the virus.)
They may intend to cause structure fires (homes) by igniting the batteries of garaged Teslas in addition to sending the ones on the road speeding out of control.
All the NSA can do in a situation like this is warn companies of specific and hypothetical threats, although in this case, it exists in the realm halfway between hypothetical and specific. Sure, they might have left those snippets of emails for us to find just to "troll" us, but I sincerely doubt that.
This is the kind of situation where I can envision a lot of hand-wringing after the fact a la "No one ever could have anticipated that Bluetooth could be used in this fashion to affect such mass death" but the fact is, Bluetooth hacks of Tesla's infotainment system were demonstrated years ago by Vice Magazine and very little was done to address it. This may be where Revil got the idea.
For Tesla's part, they might try looking very closely at whether firmwares have been modded without their input and to look for any instruction pertaining to a specific date and time that a hacker might want to coordinate all of this. Tesla firmwares update frequently, but here's the complication: The Android devices, all of them in the country, collectively, would re-infect all of the compromised Teslas in this scenario, if Tesla tried to restore firmware remotely to clean the slate. If they actually cared to, they might look at what lines of code are being changed by the virus, but that would require a reverse dump of the code already in the computers of the cars, something they don't normally do unless a software crash occurs, like any other software crash. My understanding is that Tesla would likely come back and claim they only have the capability to send updates, not to "crawl" the computer systems in the cars to check and see if a third party has altered them, although I would personally distrust such a claim. Such a virus would be designed to re-infect any Tesla in the event an unexpected firmware update runs.
***
In this scenario, which I must emphasize is a hypothetical scenario, the only Teslas that would be safe would be those that are street-parked, and here is why:
Overcharging the batteries is just one part of the equation. The engineers at Tesla did not anticipate that someone would ever be driving the car and charging the battery at the same time. Have you ever played a game on a smart phone and had the phone charging a the same time? Use of the phone makes it warm, in and of itself. Charging the phone makes it warm, in and of itself. Both charging and discharging at the same time, even with a small 5000mAh battery, brings the temp to safety limits.
Most Tesla owners garage their vehicles and charge at home, or even run an extension cord to a car in the driveway. If a virus were programmed to not only overcharge to 110%, but to execute a discharge and charge at the same time (safety protocols would ordinarily prohibit this for obvious reasons) then a fire would be a near-certainty.
Should such activity take place in the middle of the night, homeowners would likely not wake up until it was too late.
All of the safety features are based upon software, and that means they can be manipulated or made to stand down at will.
Comments
Post a Comment