Chinese hackers who took over some control of a Tesla car from 12 miles (20km) away notified the automaker and the vulnerability was fixed quickly with an over the air upgrade. The hackers will be rewarded under Tesla's 'bug bounty program'.
According to theregister.co.uk, Keen Security Lab senior researchers Sen Nie, Ling Liu, and Wen Lu, along with director Samuel Lv, demonstrated the hacks against a Tesla Model S P85 and 75D and said their efforts would work on multiple Tesla models.
Go deeper with GlobalData
Details were privately disclosed to Tesla.
The firm reportedly worked on the attack for several months, eventually gaining access to the motor that moves the driver's seat, turning on indicators, opening the car's sunroof and activating wipers.
Keen Security Lab's attacks also appear to compromise the touch screen that controls many of a Tesla's functions.
"We are able to fold the side mirrors when drivers are changing lanes," Nie said in a demonstration video. "All attacks are contactless without physically modifying the car."
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThe team demonstrated the remote attacks by triggering very sudden braking while director Lv's model 75D was in motion at slow speed in a car park. The researchers compromised the Teslas in both parking and driving modes. Director Lv said this type of research was important as cars become more automated and tech-dependent.
He urged drivers to apply any updates when Telsa made them available.
A Tesla spokesman told El Reg: "Within just 10 days of receiving this report, Tesla has already deployed an over-the-air software update (v7.1, 2.36.31) that addresses the potential security issues. The issue demonstrated is only triggered when the web browser is used, and also required the car to be physically near to and connected to a malicious wi-fi hotspot. Our realistic estimate is that the risk to our customers was very low, but this did not stop us from responding quickly.
"We engaged with the security research community to test the security of our products so that we can fix potential vulnerabilities before they result in issues for our customers. We commend the research team behind [the] demonstration and plan to reward them under our bug bounty program, which was set up to encourage this type of research."
