Talk about a hat trick. Hackers – sorry, security experts – at mobile cybersecurity firm Lookout have successfully compromised a Tesla Model S. This is the third connected car hack in the last two weeks, as of this writing.
Researcher Kevin Mahaffey published his findings on the Lookout blog conveniently on opening day of the 23rd annual Def Con hacking conference in Las Vegas. While he plans to divulge even more details during a talk at the three-day event, Mahaffey was quick to point out that this hack required "initial physical access to the car."
Moreover, being benevolent hackers – or white hats – Mahaffey and partner Marc Rogers of web performance and security firm CloudFlare have already worked with Tesla to issue an over-the-air security update the week of Def Con before publishing their findings.
Assuming (nearly) direct control
Mahaffey goes into exhaustive detail in his blog entry regarding the specifics of the hack. While the researcher commends Tesla for how well it separated its massive infotainment system from the rest of the car's controls at a top level, all it took for Mahaffey to get in was to compromise one part of the system directly and go from there.
After gaining direct control of the entire system through process of elimination, Mahaffey and his partner in crime (for good) were able to perform any action possible from the car's touchscreen or Tesla's accompanying smartphone app. On one occasion, the security guru successfully turned the car off while it was driving.
"At low speeds, the car applies the parking brake and it immediately comes to a stop, Mahaffey writes. "At speeds above about 5 miles per hour, the Model S gracefully shuts off its engine—just like shifting a gasoline car into neutral—while still providing the driver full control over steering and brakes so they can safely bring the car to a stop."
Every hack helps
Good to know! But how do we avoid these sorts of compromises in the future, especially when cars are only to become more connected? For starters, Mahaffey tells auto makers to start putting their cars' critical systems into closed networks that are isolated from the infotainment systems or information clusters.
This is the third reported hack on connected cars in the last two weeks alone. First, security experts assumed direct, remote control of a new Jeep Cherokee, causing parent company Fiat Chrysler to recall 1.4 million vehicles. (And it's only worse press for the firm from there.)
Short after, another white hat hacker revealed a flaw in OnStar's connected system that left any General Motors car equipped with the service wide open to remote door unlocks and ignition starts. In short, for who knows how long, any OnStar-equipped GM car could be jacked hands free.
Of course, this string of scary but ultimately good hackings is no coincidence, with Def Con 2015 well under way as of this writing. But nevertheless, if this past month hasn't opened everyone's eyes to the folly surrounding security in connected cars right now, then nothing will.
