Researchers Show How to Steal Tesla Car by Hacking into Owner's Smartphone

tesla car

Friday, November 25, 2016 Mohit Kumar



New technology is always a little scary, so are Smart Cars. From GPS system and satellite radio to wireless locks, steering, brakes, and accelerator, today vehicles are more connected to networks than ever, and so they are more hackable than ever.

It's not new for security researchers to hack connected cars. Previously they had demonstrated how to hijack a car remotely, and how to disable car's crucial functions like airbags by exploiting security bugs affecting significant automobiles.

Now this time, researchers at Norway-based security firm Promon have demonstrated how easy it is for hackers to steal Tesla cars through the company's official Android application that many car owners use to interact with their vehicle.



Two months ago, Chinese security researchers from Keen Lab managed to hack a Tesla Model S, which allowed them to control a car in both Parking and Driving Mode from 12 miles away.

However, Promon researchers have taken an entirely different approach.


Tesla Stores OAuth Token in Plaintext
The researchers infected a Tesla owner's phone with Android malware by compromising the Tesla's smartphone app, allowing them to locate, unlock and drive away with a Tesla Model S.

However, Tesla has clarified that the vulnerabilities used in the latest attack do not reside in its app, rather the attack employed known social engineering techniques that trick people into installing malware on their Android devices, which compromise their entire phone and all apps, including Tesla app.

In a blog post, Promon researchers explained that Tesla app generates an OAuth token when a Tesla owner log in to the Android app for the first time. The app then uses this token, without requiring the username and password every time the owner re-opens the app.



This OAuth token is then stored in plain text into the device’s system folder which can be accessed by privileged root user only.


Researchers Demonstrates How to Steal a Tesla Car:
According to researchers, it is easy for an attacker to develop a malicious app that contains Android rooting exploits such as Towelroot and Kingroot, which can then be used to escalate the malicious app's privileges, allowing attackers to read OAuth token from the Tesla app.

Stealing this token could enable an attacker to locate the car and open its doors, but could not help the attacker start and drive away with the owner's car.

For this, the malware needs to delete the OAuth token from the owner's phone, which prompts the owner to enter his/her username and password again, allowing the attacker to collect the owner's login credentials.

Researchers say this can be done by modifying the original Tesla app's source code. Since the malware has already rooted the owner's smartphone, it can alter the Tesla app and send a copy of the victim's username and password to the attacker.

With this data, the attacker can perform a series of actions, like locating the car on the road, open its doors, start the car's motor and drive the car away unhindered, just by sending well-crafted HTTP requests to the Tesla servers with the owner's OAuth token and password.

Tesla says it is not the issue with its product but common social engineering tricks used by attackers to first compromise victim's phone, rooting the device and then altering its apps data.

The researchers' attack is only possible when an attacker convinces a victim into downloading a malicious app on his/her Android device.

Mozilla announces Equal Rating Innovation Challenge, for getting more people online

  01 Nov 2016 , 16:12

Free-software community Mozilla on Tuesday announced the launch of its global “Equal Rating Innovation Challenge”, inviting entrepreneurs, designers, researchers and innovators to propose creative and scalable ideas for connecting more people to the Internet.

The contest will support promising solutions through expert mentorship and $250,000 in prize money, split into three categories — Best Overall (based on scalability), Best Overall Runner-up and Most Novel Solution (based on experiment with a potential high reward).

“This challenge is designed to spur innovations for bringing the members of the next billion online,” said Katharina Borchert, Chief Innovation Officer, Mozilla, in a statement.

According to the data from a 2014 McKinsey report, India comes under the “Medium-High” category of regions facing barriers for Internet adoption.

Broadly, the challenges are due to lack of incentives and infrastructure as well as mixed demographics.

“Connecting the unconnected is one of the greatest challenges of our time,” Borchert added.

Mozilla has launched www.equalrating.com, a website offering educational content and background information to support the challenge.

In the coming weeks, Mozilla will also stream a series of webinars to further inform potential applicants about the challenge details.

Interested innovators can submit their ideas and contact equalrating@mozilla.com for further details, the company said.

IANS

Researchers develop prototype of next-generation lithium-sulphur battery

  27 Oct 2016 , 17:59

Researchers, including one of Indian-origin, have developed a prototype of a next-generation lithium-sulphur battery which takes its inspiration in part from the cells lining the human intestine. The batteries, if commercially developed, would have five times the energy density of the lithium-ion batteries used in smartphones and other electronics, the study said.

Working with collaborators at the Beijing Institute of Technology, the Cambridge University researchers based in Vasant Kumar’s team in the Department of Materials Science and Metallurgy developed and tested a lightweight nanostructured material which resembles villi, the finger-like protrusions which line the small intestine. In the human body, villi are used to absorb the products of digestion and increase the surface area over which this process can take place.

In the new lithium-sulphur battery, a layer of material with a villi-like structure, made from tiny zinc oxide wires, is placed on the surface of one of the battery’s electrodes. This can trap fragments of the active material when they break off, keeping them electrochemically accessible and allowing the material to be reused. “This gets us a long way through the bottleneck which is preventing the development of better batteries,” said study co-author Paul Coxon from Cambridge’s Department of Materials Science and Metallurgy.

Sulphur and lithium react differently, via a multi-electron transfer mechanism meaning that elemental sulphur can offer a much higher theoretical capacity, resulting in a lithium-sulphur battery with much higher energy density. However, when the battery discharges, the lithium and sulphur interact and the ring-like sulphur molecules transform into chain-like structures, known as a poly-sulphides. As the battery undergoes several charge-discharge cycles, bits of the poly-sulphide can go into the electrolyte, so that over time the battery gradually loses active material.

By preventing the degradation of the battery caused by the loss of material within it, the new design, reported in the journal Advanced Functional Materials, overcomes one of the key technical problems hindering the commercial development of lithium-sulphur batteries.

IANS

Researchers make a portable smartphone lab to detect cancer

Image Credits: Jon Fingas, Flickr

  19 Oct 2016 , 17:48

In a major step towards faster and convenient delivery of medical tests, Washington State University researchers have developed a low-cost, portable laboratory on a smartphone that can analyse several samples at once to catch a cancer biomarker, producing lab quality results.

At a time when patients and medical professionals expect always faster results, researchers are trying to translate biodetection technologies used in laboratories to the field and clinic, so patients can get nearly instant diagnoses in a physician’s office, an ambulance or the emergency room. The research team created an eight channel smartphone spectrometer that can detect human interleukin-6 (IL-6), a known biomarker for lung, prostate, liver, breast and epithelial cancers.

A spectrometer analyses the amount and type of chemicals in a sample by measuring the light spectrum. “The spectrometer would be especially useful in clinics and hospitals that have a large number of samples without on-site labs, or for doctors who practice abroad or in remote areas,” said lead researcher Lei Li, Assistant Professor in the School of Mechanical and Materials Engineering.

“They can’t carry a whole lab with them. They need a portable and efficient device,” Li noted. Although smartphone spectrometers exist, they only monitor or measure a single sample at a time, making them inefficient for real world applications. The multichannel spectrometer can measure up to eight different samples at once using a common test called ELISA that identifies antibodies and colour change as disease markers, according to a study published in the journal Biosensors and Bioelectronics.

“With our eight channel spectrometer, we can put eight different samples to do the same test, or one sample in eight different wells to do eight different tests. This increases our device’s efficiency,” said Li, who has filed a provisional patent for the work. Although the system currently works with an iPhone 5, the researchers said they are creating an adjustable design that will be compatible with any smartphone.

IANS

Researchers engineer a new material that can make computers 100 times more energy efficient

Image: Reuters

  05 Oct 2016 , 14:06

Researchers including one of Indian-origin have engineered a material that could lead to a new generation of computing devices, packing in more computing power while consuming nearly 100 times less energy thant today’s electronics require. “Electronics are the fastest-growing consumer of energy worldwide,” said one of the study authors, Ramamoorthy Ramesh from Lawrence Berkeley National Laboratory in the US.

“Today, about five per cent of our total global energy consumption is spent on electronics, and that’s projected to grow to 40-50 percent by 2030 if we continue at the current pace and if there are no major advances in the field that lead to lower energy consumption,” Ramesh said. Known as a magnetoelectric multiferroic material, it combines electrical and magnetic properties at room temperature and relies on a phenomenon called “planar rumpling.”

The new material sandwiches together individual layers of atoms, producing a thin film with magnetic polarity that can be flipped from positive to negative or vice versa with small pulses of electricity.  In the future, device-makers could use this property to store the binary digits that underpin computing devices. “Before this work, there was only one other room-temperature multiferroic whose magnetic properties could be controlled by electricity,” said John Heron, Assistant Professor at University of Michigan who worked on the material with researchers at Cornell University.

“That electrical control is what excites electronics makers, so this is a huge step forward,” Heron noted. Room-temperature multiferroics are a hotly pursued goal in the electronics field because they require much less power to read and write data than today’s semiconductor-based devices.  In addition, their data doesn’t vanish when the power is shut off. Those properties could enable devices that require only brief pulses of electricity instead of the constant stream that’s needed for current electronics, using an estimated 100 times less energy. A paper on the work was published in the journal Nature.

IANS