Hackers infiltrated Tesla Kubernetes consoles that were not password protected, took AWS credentials, began crypto-mining; issue now fixed
RedLock Blog :
Context & Ripple Effects
RedLock's disclosure lands mid-arc for Kubernetes: earlier in 2018 the platform was already under scrutiny, and by December a Kubernetes flaw letting any user gain full admin privileges on cluster nodes would force another round of patching. The Tesla breach is the misconfiguration variant of the same problem — no exploit needed, just an open console.
The credential-theft thread also runs through the broader corpus: hackers later walked away with 71K+ Nvidia staff credentials, many cracked and circulated, and Resecurity reported stolen logins for customer-support systems at Amazon, Apple, BMW and others. Tesla's case is the earliest data point here of cloud credentials themselves becoming the loot.
First-order effects
- Tesla is directly paying the bill: miners ran on its AWS account using exfiltrated credentials, so the immediate fix is locking the consoles and rotating the exposed keys.
- AWS absorbs the abuse on its side — hijacked customer credentials mean unauthorized compute billed to a legitimate account, the exact scenario its shared-responsibility messaging leaves to customers.
Second-order effects
- Every other company running Kubernetes consoles now faces the same scan-and-mine playbook, since attackers who found one open console had every incentive to sweep for more.
- Cloud security vendors like RedLock gain the commercial opening: continuous monitoring for exposed management surfaces becomes a sellable product line rather than an audit afterthought.
Third-order effects
- If the pattern holds — open consoles, then stolen staff credentials at Nvidia, then harvested support logins at major brands — the industry shifts toward default-deny configurations and centralized secrets management instead of long-lived keys embedded in clusters.
- Kubernetes' security posture gets defined less by core features than by the accumulation of these incidents, pushing operators toward hardened distributions and managed offerings where defaults are locked down.
The trend: Cloud infrastructure attacks are converging on stolen credentials and misconfigured control planes, with crypto-mining as the monetization layer.