Tesla's cloud hacked to mine cryptocurrencies

RedLock told Tesla about the security hole so it could be rectified

RedLock has revealed its security hackers broke into Tesla's cloud and stole the resources they needed to mine cryptocurrency because the car giant hadn't secured its open source systems.

The security researcher revealed the findings in its Cloud Security Trends report, saying that attacks to mine cryptocurrency are on the rise, but many of the incidents are able to happen because of poor "user and API access hygiene."

In addition, businesses aren't monitoring their entire cloud infrastructure, meaning when an attack does happen, it often goes unnoticed until it's too late.

RedLock did advise Tesla that it was able to access the credentials it needed to break into Tesla's AWS environment. Upon further investigation, researchers at the security firm were able to access an Amazon S3 bucket, which stored sensitive data such as telemetry.

"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," a Tesla spokesperson told Gizmodo.

"The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way."

However, the incident spurred RedLock to look into access key hygiene and it discovered that 40 percent of access keys have not been rotated in the recommended 90-day period, while almost three-quarters of businesses are allowing root user activities.

A combination of these two security malpractices means that hackers would potentially be able to find highly sensitive information much easier than if businesses employed best practice to their cloud security.

RedLock thinks this kind of attack will increase in intensity in the coming months, making it vital businesses monitor their cloud environments for any potential holes.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Alkira offers Check Point CloudGuard Security to secure virtual cloud networks
Cloud

Alkira offers Check Point CloudGuard Security to secure virtual cloud networks

29 Sep 2021
Iboss protects web sessions with remote browser isolation
Cloud

Iboss protects web sessions with remote browser isolation

16 Aug 2021
Most CISOs worry cloud software flaws aren’t being caught
cloud security

Most CISOs worry cloud software flaws aren’t being caught

7 Jun 2021

Most Popular

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021