Hacker News Reader

Comment by jandrese | Hacker News Reader

Like most "hacking" instances in real life this was an exploit of the service desk. He called Tesla support and had the VIN (easily readable through the windshield as required by law) added to his account so he could use the app on his phone to access the car.

This seems like a big security hole, but it puts a giant arrow on the thief that lets them be caught easily. It's a trap for dumb thieves. Basically only good for going for a joyride.

Tesla definitely needs to harden their support desk however, because that's just embarrassingly bad.

View on HN

The automaker told Electrek that the alleged car thief likely had previously rented the vehicle and had an already-authenticated phone as a result. The owner of Trevla reportedly refuted this claim, stating that he had removed the phone's access following this person’s prior rental.

I suspect that the service desk could see that the phone was previously authenticated with that car. My theory is that between that and the VIN, the thief was able to social engineer the service desk into re-authenticating.

As currently realized, service desks can't be hardened against people with inside information, unless bad customer experiences for innocent customers are tolerated. This isn't just Tesla. Any company with customer service is probably like this. Either they're pushovers with decent customer service, or customers think they're a pain.

Couldn't the thief pretty easily set up an account and call from a burner phone?

Depends if you need to buy a Tesla first to set up an account.

Doesn't the car have a built-in GPS tracker anyway?

From the article: "Since this person disabled GPS tracking on the car, the owner had to utilize a different method of tracking down the alleged crook."

That the thief disabled. They tracked him via superCharger stops.

A gps jammer can be picked up for $20 on ebay.

So the "hacking" part was convincing a support agent to give him access, and the "with a smartphone" part was using the phone to talk to the agent?

>"hacking"

Whatever gets you access.

>"with a smartphone"

The smartphone was both used to talk to the agent and also, once authorized, to unlock and turn on the car. See below:

"The person allegedly responsible for taking the car is believed to have reached out to Tesla's customer support to add the stolen Model 3 to his Tesla account by its vehicle identification number. Once the vehicle was accessible on a smartphone that was signed into this person’s account, he was reportedly able to unlock the car and drive away without ever needing a key."

> >"hacking"

> Whatever gets you access.

Social Engineering.

The smartphone lets you unlock the car and drive off. Keyless entry.

Social Engineering is in scope for Security Penetration Testing

Asking someone = social engineering = hack.

Reply on news.ycombinator.com