Cloud security company RedLock found the incident and notified Tesla, which now confirms that hackers have breached its cloud computing platform to mine cryptocurrency.
The Tesla corporation resolved the vulnerability that the hackers used to infiltrate their cloud servers and install a cryptocurrency miner.
With a Kubernetes console that was apparently not password-protected, the attackers were able to access Tesla's Amazon Web Services environment.
The Tesla engineers were responsible for the security breech, according to RedLock, as they neglected to add an authentication system to the Kubernetes console.
Source: https://securityaffairs.com/69413/data-breach/tesla-servers-hacked.html
TPRM report: https://scoringcyber.rankiteo.com/company/tesla-motors
"id": "tes344181223",
"linkid": "tesla-motors",
"type": "Breach",
"date": "02/2018",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'industry': 'Automobile and Energy',
'location': 'Palo Alto, California, USA',
'name': 'Tesla',
'size': 'Large',
'type': 'Corporation'}],
'attack_vector': 'Unprotected Kubernetes console',
'description': "Hackers breached Tesla's cloud computing platform to mine "
'cryptocurrency by exploiting a vulnerability in an '
'unprotected Kubernetes console.',
'impact': {'systems_affected': "Tesla's Amazon Web Services environment"},
'initial_access_broker': {'entry_point': 'Unprotected Kubernetes console'},
'lessons_learned': 'Ensure authentication systems are in place for all '
'consoles and critical systems.',
'motivation': 'Cryptocurrency mining',
'post_incident_analysis': {'corrective_actions': 'Implement authentication '
'systems',
'root_causes': 'Lack of authentication on '
'Kubernetes console'},
'references': [{'source': 'RedLock'}],
'response': {'remediation_measures': 'Resolved the vulnerability',
'third_party_assistance': 'RedLock'},
'threat_actor': 'Unknown',
'title': 'Tesla Cloud Platform Breach for Cryptocurrency Mining',
'type': 'Cloud Security Breach',
'vulnerability_exploited': 'Lack of authentication on Kubernetes console'}