Tesla introduces code signing to harden their cars’ security

When researchers from Tencent’s Keen Security Lab discovered that they were able to leverage vulnerabilities to remotely hijack Tesla cars, they reported the issues to the automotive company and rushed them into implementing a security feature they have been working on for a while: code signing.

The vulnerabilities were several, including one in Tesla S’ browser that would allow attackers to direct users towards a website hosting the malicious payload, and a privilege elevation flaw in the car’s Linux operating system that would allow attackers full access to the car’s head unit.

From there, they managed to send specific commands to the car’s driving components through the car’s CAN bus, by overwriting the firmware of the gateway that keeps the two systems separated and allows only certain messages to be sent through.

Tesla Motors was informed of the issues in early September, and by the time the researchers revealed their findings to the general public, an update with the new feature and the fixes had already been delivered to Tesla car owners via the over-the-air update mechanism.

Code signing, i.e. the signing of software (firmware) with a digital signature possessed only by the manufacturer, is a feature that has long been used to make sure that computers and smartphones run legitimate (non-malicious) software and software updates.

But despite organizations like I Am the Cavalry advising the automotive industry to implement code signing, big automakers resist the change.

Josh Corman, one of the founders of I Am the Cavalry, told Wired that he believes their resistance to the implementation of the feature is partly due to the fact that, unlike Tesla, they have less control over their supply chains, dealers, and aftermarket tools and mechanics.

But, in time, as the (in)security of connected vehicles becomes increasingly important, they will have to find a way to make the change, or risk getting passed over by consumers.

One of Tesla Motors’ stated goals is to serve as a positive example to other automakers. Let’s hope other automakers with follow their lead when it comes to the security of their cars’ computer systems.