Tesla S - Shutterstock - © Robert Gubbins

Tesla ‘Hack’ Can Unlock Car Doors

Researcher warns of attacks on Tesla apps and the manufacturer’s website

On by Thomas Brewster 0

Weaknesses in the way Tesla lets drivers control their cars could allow someone to easily open the doors to one of the super-efficient vehicles, a security researcher has warned.

Whilst praising the Tesla Model S for its innovation, Nitesh Dhanjani said the car manufacturer’s website did not appear to have any particular account lockout policy when large numbers of login attempts were made.

A brute force attempt on the login pages could therefore open up user accounts, he said. Similar tactics could be used to gain access to the iPhone app, which allows the user to unlock the car, determine its location and view its charge status.

Tesla - Shutterstock - © Hattanas KumchaiBrute forcing Tesla logins

“Tesla should address the issue of using static passwords with low complexity requirements,” Dhanjani said in a blog post.

“Tesla owners should be aware of risks based on the current situation and take precautions.” Those precautions should include stronger passwords, added Dhanjani, who had presented his findings at BlackHat Asia.

He also warned of the potential for malicious third-party applications to connect to the Tesla application programming interface (API). It appeared, looking at the Google Glass app for Tesla, that those apps connecting to the API would handle logins for users, indicating usernames and passwords would be shared with the third-party software.

“Until Tesla announces an SDK and methods they are going to outline to sandbox applications, users should refrain from using third party applications,” he added.

“Given the serious nature of this topic, we know we can’t attempt to secure our vehicles the way we have attempted to secure our workstations at home in the past by relying on static passwords and trusted networks. The implications to physical security and privacy in this context have raised stakes to the next level.”

Tesla had not responded to a request for comment at the time of publication.

The car company has a responsible vulnerability disclosure programme and has hired various big name security professionals to ensure its cars are safe. That included the  “hacker princess” of Apple, Kristin Paget.

Are you a security pro? Try our quiz!

Thomas Brewster
Author: Thomas Brewster
Security Correspondent, TechWeekEurope
Thomas Brewster Thomas Brewster Thomas Brewster

White Papers

Techweekeurope for mobile devices
Android-App Google Currents App for iOS

Last comment




0 replies to Tesla ‘Hack’ Can Unlock Car Doors

Leave a Reply

  • Required fields are marked *,
    Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>