Hackers hacked Tesla AWS account to mine

People's love for Tesla is at two extremes.

At one extreme, after someone got into a serious car accident while driving a Tesla, the person enthusiastically reported the bug to Tesla officials without saying anything, and then casually ordered a new Tesla.

Some people... hacked into Tesla's AWS account just to mine.

Hackers accessed Tesla's Amazon cloud account and used it to run mining software, researchers at security firm RedLock said in a report on Tuesday. The researchers said the incident was similar to the plight of Gemalto, the world's largest SIM card manufacturer, and Aviva, a multinational insurance company.

In October, hackers gained access to cloud accounts at both Amazon and Microsoft after discovering that access credentials were not being properly secured, using them to run a wave of coin-mining malware.

Tuesday's report said the initial entry point into the Tesla cloud breach was an insecure management console for Kubernetes, the open-source software package that companies use to deploy and manage vast swathes of cloud-based applications and resources.

"The hackers penetrated Tesla's unprotected Kubernetes console," RedLock researchers wrote. "In a Kubernetes pod, access credentials were exposed to Tesla's AWS environment, which contained sensitive data such as telemetry."

In order to hide their tracks and avoid being discovered too early, thus disrupting the mining plan, the attackers hid the IP address of the malware in the security company Cloudflare. They also configured the mining software to access the Internet using non-standard ports and connect to unlisted or semi-public endpoints instead of known mining pools. The attackers may also cut CPU resources used to mine digital coins. These measures can help hide illegal mining and make it difficult to detect.

In addition to allowing the attackers to run mining malware, RedLock said the hackers' intrusion also exposed certain non-public Tesla data, including sensitive telemetry information related to Tesla vehicles. RedLock said it has reported the discovery to Tesla.

In an email, a Tesla representative wrote: "We have a bug bounty program to encourage this kind of research, and we fixed the vulnerability within hours of learning about it. This hack appears to have only affected internal engineering test vehicles, and after initial investigation, we have not found any customer privacy or vehicle security impacted by this incident."

Researchers also recently discovered that a trove of sensitive FedEx customer data was exposed on a publicly accessible Amazon storage site and could have been available to anyone for years. Researchers also reported that cryptocurrency malware is even making some companies unable to operate.

It seems that the black tycoons can't resist the urge to mine, and even ignore the "Tesla" that everyone loves.

Translated from ars Technica