Tesla’s Model S has been hacked to make the doors and sun roof open while the car is in motion - and the researchers behind the attack were also able to switch on the headlights and sound the horn by remote control, according to Ubergizmo's report.
The hack, performed by Zhejiang University students as part of a competition, exploited an unspecified flaw in the flow design of the car to gain control of systems including the door locks, windscreen wipers and lighting via the car's central control system.
Tesla did not officially support the competition, but welcomed the publication of the exploit and said it would investigate. While security researchers have previously demonstrated successful attacks against various models of 'connected' vehicles, wireless attacks which work while the vehicle is in motion are rare.
Tesla Model S - hacker target
The car - a high-profile 'flagship' for the electric sportscar market - has been the focus of much security research, due to its integration of computer components (the dashboard includes a connected touch panel), and reliance on apps for functions such as opening the doors. This week's hack is the first to compromise multiple systems remotely - although the researchers have not as yet revealed their methodology.
The team won a reported prize of $10,000 for the hack, offered as part of the annual Syscan conference in Beijing according to The Register's report.
Teams were challenged to compromise the 17-inch touch panel which forms the centrepiece of the Model S’s dashboard, according to Autoblog’s report. The hack had to be carried out remotely, according to the rules of the contest. The car maintains a connection to the internet via syncing with the driver’s mobile device.
In a statement, the electric car company said that it was in favour of "the idea of providing an environment in which responsible security researchers can help identify potential vulnerabilities.”
This week's hack follows previous exploits which could allow potential attackers to bypass locking systems on the car's paired app.
Earlier this year, security questions were raised over the app-based “key” used to unlock the electric supercar Tesla – after a researcher showed it was possible to guess the key’s six-digit PIN by brute force. The Tesla car is “locked” using an iPhone app, accesssed via a basic six-character password, according to Sky News.
Tesla Model S - dawn of 'cyberjacking'?
As wireless technologies and electronic controls are increasingly built into cars, vehicles could become vulnerable to hackers – either stealing information, or injecting malware, a U.S. Senator warned in a letter to 20 major auto manufacturers last year.
Senator Edward J Markey, Democrat, Massachussets, pointed out in his publicly available letter that average cars now have up to 50 electronic control units, often controlled by a car “network”.
The open letter has ignited a spate of commentary, with Market Oracle describing the crime as “cyberjacking”, and pointing out that the average family car contains 100 million lines of computer code, and that software can account for up to 40% of the cost of the vehicle, according to researchers at the University of Wisconsin-Madison.
Hacks against cars have been demonstrated before – but thus far, have relied on attackers having physical access to the vehicles. At the DefCon conference in 2013, two researchers showed how they could seize control of two car models from Toyota and Ford by plugging a laptop into a port usually used for diagnostics, as reported by We Live Security here.
This week's hack against Tesla's flagship could mark a new stage in "cyberjacking" - where attackers could compromise a vehicle remotely, without first accessing the car's hardware.
