Companies need to work harder and harder to maintain excellent security measures these days. Tesla’s website was hacked last month, and the initial discovery and information about it was just published by a cloud monitoring and defense firm, Red Lock, earlier this week. Researchers found out that some of Tesla’s Amazon Web Services cloud infrastructure was being utilized to run mining malware in a well-concealed and far-reaching crypto theft campaign last month. They quickly reported their findings to Tesla.
Tesla quickly moved to decontaminate and lock down its cloud platform within a day. The company’s first investigation indicates that data exposure was minor. However, the event further displayed how cryptojacking can pose a large security threat—in addition to racking up a large, unwanted electricity bill.
Red Lock found the hacking program while searching the public internet for misconfigured and unsecured cloud servers, a security measure that more and more companies depend on as exposures from database misconfigurations increase.
“We got alerted that this is an open server and when we investigated it further that’s when we saw that it was actually running a Kubernetes, which was doing cryptomining,” shared Gaurav Kumar, chief technology officer of Red Lock. He went on to explain, “And then we found that, oh, it actually belongs to Tesla.”
These hackers realized that this particular Kubernetes console—an administrative portal for cloud application management—was not protected by a password and could be accessed by anyone. This allowed them to insert scripts to employ their theft operation, built on the popular Stratum Bitcoin mining protocol.
A Tesla spokesperson shared, “We addressed this vulnerability within hours of learning about it. The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way.”
Although it does not appear they were able to create too much damage before being discovered, the Tesla hack is another example of how much bigger the hacker problem has become. Companies are going to need to put even more effort into strong security systems, to prevent further attacks.