30+ Tesla Cars Compromised Due to TeslaLogger Vulnerability
Following up on our most recent blog post regarding the threat posed by misconfigurations, a recent incident impacting Tesla places those findings under a brighter spotlight. Due to vulnerabilities caused by misconfigurations in TeslaLogger, a third-party software used for data logging, security researcher Harish SG uncovered that its insecure default settings could be exploited to gain unauthorized access. After Harish discovered the issue, it was reported to the platform's maintainer, who is expected to have taken actions to mitigate or resolve that risk.
It is essential to clarify that the vulnerability and potential remote access associated with it did not reside in Tesla's vehicles or in Tesla's infrastructure but rather stemmed from misconfigurations surrounding the use of default credentials and improper storage of API keys by TeslaLogger. Despite the introduction of no insecure software, the failure to correctly vet configurations resulted in the platform being deployed with critical vulnerabilities that impacted Tesla drivers and vehicles alike. Exploiting this flaw can have real-world consequences, as it would allow attackers to manipulate various aspects of the cars, such as unlocking doors, controlling climate systems, and performing similar nefarious activities, which could have implications for car-related crimes, such as car thefts.
Harish centered his investigation methodology around installing the platform on a laptop using Docker, followed by applying Nmap to perform reconnaissance surrounding the system's open ports. Using default credentials, he could access the backend MariaDB database operated on port 3306 and execute SQL queries to retrieve Tesla car API keys, highlighting the vulnerabilities surrounding default configurations and improper API key storage.
While Tesla's API employed Role-Based Access Control (RBAC), this ostensibly secure approach was hampered by TeslaLogger's configuration, which resulted in the application typically requesting excessive permissions, which further exacerbated the potential vulnerabilities involved in the platform. Thus, even if the database was not vulnerable through port 3306, the underlying API storage mechanism was still insecure, which allowed for workarounds, such as implementing TeslaLogger on Raspberry Pi devices as an alternative to extract the API keys.
Ultimately, these findings underscore the importance of fostering a culture of awareness within the cybersecurity community that is more focused on uncovering the dangerous threat posed by misconfigurations rather than solely being focused on CVE threats. By doing so, organizations can better safeguard their systems and prevent their exploitation by threat actors.
For more details, you can read the full report on Cybersecurity News.
Comments
Post a Comment