Tesla's cloud hacked to mine cryptocurrencies

RedLock told Tesla about the security hole so it could be rectified

RedLock has revealed its security hackers broke into Tesla's cloud and stole the resources they needed to mine cryptocurrency because the car giant hadn't secured its open source systems.

The security researcher revealed the findings in its Cloud Security Trends report, saying that attacks to mine cryptocurrency are on the rise, but many of the incidents are able to happen because of poor "user and API access hygiene."

In addition, businesses aren't monitoring their entire cloud infrastructure, meaning when an attack does happen, it often goes unnoticed until it's too late.

RedLock did advise Tesla that it was able to access the credentials it needed to break into Tesla's AWS environment. Upon further investigation, researchers at the security firm were able to access an Amazon S3 bucket, which stored sensitive data such as telemetry.

"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," a Tesla spokesperson told Gizmodo.

"The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way."

However, the incident spurred RedLock to look into access key hygiene and it discovered that 40 percent of access keys have not been rotated in the recommended 90-day period, while almost three-quarters of businesses are allowing root user activities.

A combination of these two security malpractices means that hackers would potentially be able to find highly sensitive information much easier than if businesses employed best practice to their cloud security.

RedLock thinks this kind of attack will increase in intensity in the coming months, making it vital businesses monitor their cloud environments for any potential holes.

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Recommended

Government agencies see misconfigured cloud services as top security threat
Security

Government agencies see misconfigured cloud services as top security threat

22 Oct 2020
Lookout reveals mobile-first endpoint detection and response solution
Security

Lookout reveals mobile-first endpoint detection and response solution

21 Oct 2020
Cisco finds an increase in security concerns due to remote working
Security

Cisco finds an increase in security concerns due to remote working

21 Oct 2020
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020

Most Popular

The enemy of security is complexity
Sponsored

The enemy of security is complexity

9 Oct 2020
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

5 Oct 2020