Grand Theft Tesla: Android App Hack Unlocks, Starts Car

News
By published

Norwegian researchers hacked the Tesla Android app to unlock a Tesla car and drive it away without a keyfob.

Tesla drivers using the company's Android app to control their cars could be facing serious safety concerns, according to security researchers who demonstrated in a video that anyone with a laptop and Android hacking skills can exploit the app to unlock, start and drive away a stranger's Tesla.

Credit: Tesla

(Image credit: Tesla)

The problem exists in part, the Promon blog post said, because many Android phone manufacturers aren't delivering operating-system security patches needed to prevent cyber attacks. More current versions of Android such as Android 6 Marshmallow or Android 7 Nougat make the attack more difficult, but not impossible.

MORE: Best Android Antivirus and Security Apps

This specific exploit used a malicious app downloaded from the Google Play app store on a non-rooted 2014 Samsung Galaxy A5 running Android 5.0 Lollipop, the most recent version of the OS compatible with that model of phone. These Tesla owners would have to unknowingly download such a malicious app, but that happens frequently enough, even in the official Google Play app store.

The Tesla Model S sedan.

The Tesla Model S sedan.

Furthermore, this exploit applies only to Tesla drivers who have set up the Android app so that they don't need to enter their login credentials every time they use it. Doing so creates an authentication token that's valid for 90 days, but which the Tesla app does not protect with encryption. Many kinds of Android malware could copy and re-use the Tesla authentication token to gain access to the car.

However, the malware needs to also capture the user's actual username and password to start the car's engine. Again, many kinds of Android malware could do so.

This type of mobile-app vulnerability isn't limited to the Tesla app. The lack of security updates could allow hackers to access other Android apps, Promon says, but the ability to take control of a Tesla owner's car is particularly disturbing and potentially dangerous for more than just a vehicle's owner.

To prevent your Tesla from disappearing from your driveway, disable the feature that lets you go 90 days without logging into the Android app. Update your phone's operating system to Marshmallow or Nougat. (If you can't, but you own a Tesla, then you can afford a new phone.) Install and run Android security software that can catch and block most kinds of Android malware. And be very careful when installing Android apps you're not familiar with.

TOPICS
Althea Chang

Althea Chang is Associate Director of Content Development for Consumer Reports and was previously a Senior Writer for Tom's Guide, covering mobile devices, health and fitness gadgets and car tech. 

1 Comment Comment from the forums
  • Bob_127
    The easier it is to hack into and "steal" a car, the easier it is to instantly locate it once it is stolen, and also to disable it.
    Reply