← Back to context

Comment by kotaKat

1 day ago

I'm amused reading the terms and requirements the author mentions in the bug bounty program for researchers gaining root access (under 'Vehicle Targets') - https://bugcrowd.com/engagements/tesla

"To promote further security research, Tesla offers security researchers the opportunity to retain root access on their infotainment system even after their reported vulnerability has been patched. In order to qualify, a researcher must send in a valid report describing a novel way to gain root access on a Tesla infotainment system. Upon confirmation, Tesla will instruct the researcher on how to use their existing root access to enable the researcher SSH feature, along with an SSH certificate for the researcher's public key (tailored to their specific hardware ID). The certificate restricts SSH access to the local diagnostic ethernet link. Tesla may renew the certificate as long as the researcher continues reporting vulnerabilities."

Very neat.