Tesla’s cloud account was hacked and used to mine cryptocurrency, according to a security research firm. Hackers gained access to the electric car company’s Amazon cloud account, where they were able to view “sensitive data” such as vehicle telemetry, The Verge reports with a reference to RedLock.
The researchers, who work for cybersecurity firm RedLock, discovered the breach last month while searching for which organization left credentials for an Amazon Web Services (AWS) account open to the public internet. The owner turned out to be Tesla.
RedLock’s researchers say they found Tesla’s unprotected information on a Kubernetes console, a Google-designed system for optimizing cloud applications. The exposure allowed hackers to access Tesla’s cloud environment. RedLock said they immediately reported the incident to Tesla, which quickly rectified the situation. A Tesla spokesperson said that no customer data was impacted by the breach.
“We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it,” the spokesperson said. “The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way.”
According to RedLock, using Tesla’s cloud account to mine cryptocurrency is more valuable than any data stored within. The cybersecurity firm said in a report released Monday that it estimates 58 percent of organizations that use public cloud services, such as AWS, Microsoft Azure, or Google Cloud, have publicly exposed “at least one cloud storage service.” Eight percent have had cryptojacking incidents.
“The recent rise of cryptocurrencies is making it far more lucrative for cybercriminals to steal organizations’ compute power rather than their data,” RedLock CTO Gaurav Kumar told Gizmodo. “In particular, organizations’ public cloud environments are ideal targets due to the lack of effective cloud threat defense programs. In the past few months alone, we have uncovered a number of cryptojacking incidents including the one affecting Tesla.”
