discovering 49 zero-day bugs in EV systems
Holy shit that’s a lot of zero days homies
More holes than Emmental cheese lol
Holier than the Vatican
More holes than even Stanley Yelnats could dig.
Btw did you know Swiss cheese has copy protection? I know the thought is pretty random, but I thought I’d share anyway.
Parmesan does at well. At least the real stuff from Italy does.
90 days till release of Zero-Days 😉 don’t update your tesla 😂 so you can gain root and really own that car
Just flash a custom os 😂
brb flashing TempleOS to let god be my driver /s
You would have to put a lot of faith in it.
I hope it gets called something like edOSon and is filled with subtle insults to its namesake.
I’d fear it would drive into an elephant.
Pretty sure the elephant would win, after all at least one beat a steam locomotive.
You’d say ohhhh Topsey at his autopsy!
Hannah Montana OS for the Tesla!
What a time to be alive!
Scribbles
Another reason not to buy proprietary garbage. Where are the Open Source EVs at?
Open-source EVs are a bit like Gentoo, you have to build it yourself.
There actually are a lot of really cool EV conversion builds on YouTube using fairly open parts. So I’d say this is perfectly accurate.
Wait so was the hacking live?
Yes, pwn2own is a live competition
Wow. Imagine paying $1.4mil to find 49 zero days instead of hiring an actual security team.
The people who did this are fucking idiots.
bro that’s fucking cheap.
deleted by creator
$1.4 million vs the ability to steal as many Teslas as you want?
I’ll take the money…
Anti-libre software licenses can never defend us from Tesla.
Do they directly show(sell maybe) the exploits to the companies?
White hats can be prosecuted via the CFAA. they usually aren’t (most of us are guilty of CFAA penalties) but some companies got sour to fixing their web security and instead would sue and push to prosecute.
So in the early 2010s the white hat community went gray to survive. And companies that don’t pay their bounties oe cause trouble don’t get pen tested by white hats (at least not when wearing a white hat).
How do you know if a company is going to pay to fix?
Do you just have to take a chance and notify them?
Either I make a bunch of money, or they say fuck off, or they send me to jail? It seems too iffy
I assume the idea is, that the company then has a contract with the hacker, so they can no longer sue him. They essentially hack themselves via proxy.
Bounties are a bit nebulous.
Actual pen testing companies have red teams (attackers) that have a scope of what they are allowed to target, and how they go about it.
For example, just because a red teamer can get into the data center to do stuff locally doesn’t meet the scope requirement of testing their web page externally. They would be prosecuted most likely.
Pen testing companies also have lawyers, at least they should, who help negotiate scope and what is legally allowed and in what context.
Due to the secrecy needed for some tests, the security staff may not be aware a test is in place. From what I understand, generally people have some sort of paperwork on their person, or at least the contact information of someone at the company with the authority to authorize this red team pen test.
That being said, cops may still get called, you may still get arrested, and have to deal with the courts.
Or worse, some trigger happy security guard shoots you.
I’m just studying that stuff though at the moment, so take what I said with a grain of salt.
Thank you! I appreciate the insight.
Thats what white hats would do and what these contests are usually for
But its more like a bughunt with an open Bounty then selling afaik
Hell yeah brother.
