Abusing the Internet of Things

FIGURE 6-2. The TVRX daughterboard Data from the USRP was analyzed using GNU Radio, an open source software develop- ment kit th ...

From the viewpoint of privacy, one risk is that a tracking system deployed alongside roads could be used to track particular car ...

respond. However, even though these responses from the legitimate sensors contained nor- mal readings, the ECU still flashed the ...

Injecting CAN Data Miller and Valasek have done a fantastic job of explaining the structure of CAN data. It is cru- cial that we ...

The value of the result in decimal is 149, which computes to a hexadecimal representation of 0x95. This is exactly the value of ...

That’s how easy it is to send a CAN packet on a CAN bus network. For more details on how to use this tool to test and inject var ...

malicious app, the buffer overflow condition can be exploited to take over the ECU responsible for handling the Bluetooth functi ...

TIP ington claim to have successfully exploited a telematics system powered by Airbiquity’s aqLink software. This software allow ...

Significant Attack Surface The ability to surreptitiously take control of a car’s telematics ECU presents an attack surface whos ...

Furthermore, it is clear that much of the ECU software looked at by researchers contains basic software flaws such as buffer ove ...

S is far from a slow golf cart. The P85+ model (Figure 6-3) has 416 horsepower that can take it from 0 to 60 miles per hour in 4 ...

FIGURE 6-4. Tesla Supercharger stations The Model S is commonly referred to as a “computer on wheels” because it is always con- ...

FIGURE 6-5. The center display in the Tesla Model S THE TESLA MODEL S 173 ...

Locate and Steal a Tesla the Old-Fashioned Way It is common knowledge that weak passwords are a bad idea, and most popular onlin ...

FIGURE 6-6. Password complexity requirement of six characters, inclusive of one letter and one number Tesla’s increased password ...

FIGURE 6-7. Tesla iPhone app Communication between the Tesla iOS app and the Tesla cloud infrastructure has been documented by t ...

1.Log in to the stolen account by submitting a request to /login and populating the user_session field with the victim’s email a ...

Social Engineering Tesla Employees and the Quest for Location Privacy For most people who forget their car keys or lock themselv ...

TIP make sure only authorized employees have access to the data and how stored location data is secured against external entitie ...

FIGURE 6-9. Tesla for Glass login page FIGURE 6-10. Tesla website credentials are collected by a third-party app CHAPTER 6: CONN ...