Teen hacker gains remote control of over 20 Teslas

[Daniel Sims]

Facepalm: This week, a teenager reported that he has gained remote access to around two dozen Tesla cars in multiple countries and is trying to contact their owners. The list of things he can do to the affected vehicles is long and dangerous.

Nineteen-year-old IT security specialist David Columbo reported in a Twitter thread Monday and Tuesday that he gained complete control of over 25 Teslas in 13 countries without their owners knowing. He doesn’t want to disclose exactly how he did it until he reports the vulnerability to the non-profit Mitre. However, Columbo did say it was due to errors on the owners’ part, not a security flaw in Tesla’s software.

So, I now have full remote control of over 20 Tesla’s in 10 countries and there seems to be no way to find the owners and report it to them…

— David Colombo (@david_colombo_) January 10, 2022

Columbo said he could search the precise location of each car, disable their security, open their doors and windows even while they’re on the road, play music and YouTube videos at full volume, and more. While Columbo can’t remotely drive the cars, he could steal them if he were at their physical locations. Tesla’s security team has already told Columbo they’re looking into it.

Even though Columbo says this isn't Tesla's fault, it could still be a PR issue for the company, painting the cars as ever more vulnerable in consumers' minds. Near the end of last year, Tesla recalled a significant number of vehicles sold in the US over trunk lid problems. This incident could also affect the development of Tesla's self-driving mode, which is still in beta.

Permalink to story.

https://www.techspot.com/news/92971-teen-hacker-gains-remote-control-over-20-teslas.html

 

[Dimitriid]

Time for me to be inflammatory again but the kind of person that buys a Tesla seems to me to also be the exact kind of person who sets his password as "password" without giving it a second thought and then buys and NFT monkey.

 

[scavengerspc]

Time for me to be inflammatory again but the kind of person that buys a Tesla seems to me to also be the exact kind of person who sets his password as "password" without giving it a second thought and then buys and NFT monkey.

I can agree with that. You aren't going to see many failures buying either.

 

[BuckarooBonzaii]

Looks like something from James Bond but it's real.

 

[YouShallNotPass]

If he can play custom YouTube on the car, he obviously can contact the owner by video. He is either not very smart or just trying to get famous by going public.

 

[QuantumPhysics]

Looks like something from James Bond but it's real.

Terminator 3

 

[QuantumPhysics]

Imagine the hacking community when the luxury brands make it a subscription service to use features in the car like the massage seats.

 

[Kosmoz]

If he did not start mining with them, this is not news...

 

[cliffordcooley]

This is why you don't integrate infotainment with any vehicle controls. Vehicle controls needs to be isolated from all other systems.

 

[theruck]

Patching Tuesdays for Tesla next?

 

[JeromeFree]

Hmmm what to say ... teens very smart lol

 

[ypsylon]

Because nobody could see that coming from the day every car started to be stuffed with electronics from top to bottom...

Good for the lad. Nothing improves my mood more that making corporation look literally brainless. Go David, Go.

 

[Ravey]

Well done to the specialist who found the vulnerability. This is a great achievement

 

[Morphine Child]

Soon we will have cars with day one patches, DLCs and whatnot. And a few teen hackers remotely driving their annoying and rich grandparents into a river with locked doors... oh the possibilities.

 

[JamesBlond]

I take it nobody thinks its a plan...... why is there law against creating 2048bit encryption apps and hardware combo's ...?? Maybe because if its too hard for the FBI to hack your car its not good for them..???

 

[Geralt]

This looks like funny, but it could unleash a tragedy. Time to rethink the electronics of those cars.

 

[ChrisH1]

Time for me to be inflammatory again but the kind of person that buys a Tesla seems to me to also be the exact kind of person who sets his password as "password" without giving it a second thought and then buys and NFT monkey.

A generalization. I bought a Tesla, and have never set my password to 'password' or anything like it (I.e. easy to guess) in my entire life.

 

[cuerdc]

A generalization. I bought a Tesla, and have never set my password to 'password' or anything like it (I.e. easy to guess) in my entire life.

No denying the nft monkey

 

[Farkinell]

This is why you don't integrate infotainment with any vehicle controls. Vehicle controls needs to be isolated from all other systems.

This is what they’ve been doing on airplanes for decades, for this exact reason.

 

[ScottSoapbox]

I take it nobody thinks its a plan...... why is there law against creating 2048bit encryption apps and hardware combo's ...?? Maybe because if its too hard for the FBI to hack your car its not good for them..???

Higher encryption doesn't magically patch every bug and security hole.

 

[Theinsanegamer]

See...this is why I love my 30 year old truck. Cant hack a computer if it doesnt exist (or in my case, uses a 6 it cut down 8086).

Time for me to be inflammatory again but the kind of person that buys a Tesla seems to me to also be the exact kind of person who sets his password as "password" without giving it a second thought and then buys and NFT monkey.

I imagine the people who buy most teslas are the same ones that buy the newest, highest end iphone every year and subsribe to every streaming service rather then buy something they want.

model 3s are cheap enough though you see people who only buy the newest, highest end iphone every 2 years.

 

[Uncle Al]

I'm betting Musk never saw this one coming ......

 

[wiyosaya]

This looks like funny, but it could unleash a tragedy. Time to rethink the electronics of those cars.

Agreed. If a kid can do this, imagine what Tesla, itself, can do. That's a prime reason a Tesla is not on my list of possibilities when I buy my next car.

I'm betting Musk never saw this one coming ......

I have to agree.

 

[Dr Roboto]

This is why you don't integrate infotainment with any vehicle controls. Vehicle controls needs to be isolated from all other systems.

The hacker states that it not the fault of Telsa. I have to disagree. Why on earth would a person need to remotely access a lot of these features from the internet? Seriously, the security of a Telsa does not seem to be any stronger then the same password you use to login into TechSpot. You know the same passwords that people make too obvious (123456, etc.) or are stolen on a daily basis from company security breaches.

IMO, Telsa is so focused on being a cutting edge, game changing company that sometimes they just fail at basic common sense. A lot of times it works for them, but sometimes you have to look at it this way: "Just because you can, doesn't mean you should."

Now get off my lawn

 

[netman]

This could be disastrous for Musk...! If the car parts are to blame, ALL the Teslas in the World need to be recalled...!