Expert Shows Access Vulnerability In Tesla And Other Electric Vehicles

Electric cars, and more especially Tesla (which is actually a sort of "high-tech computer on wheels"), have implemented certain methods for opening, starting and exiting the vehicle, with which they dispense with the traditional key or remote control. Tesla basically transformed the key into a sort of access and unlocking card for the EV itself; however, a cybersecurity specialist has shown how these same technology features will make it easier for malicious hackers to potentially get full control of one of these electric vehicles.

It is Sultan Qasim Khan, a specialist and principal security consultant at NCC Group, who publicly demonstrated how easy it can be for a malicious hacker to access an EV model, start it and even drive without the need to have an original access card, which Tesla normally uses. The mechanism used by Tesla is allegedly the easiest to imitate and hack, according to him; however, he clearly states that other brands and models could also be vulnerable.

The hack is carried out when the thief diverts all the wireless communication protocols – "handshake" - that the car normally establishes with the corresponding EV access card, to an encrypted mobile phone that contains all these same parameters (previously copied there, obviously), thus tricking the system itself into believing that the user is carrying said card, when in reality it is just an encrypted smartphone. As already mentioned, it can also be carried out on other vehicles - electric or not - since the coding will be that of the car's own wireless control; it would only be necessary to have a keyless access in order to start and actually control the vehicle.

Despite the trick being relatively easy – up to a certain point, for an expert hacker -, at the moment there is no known evidence that it has actually been already used in order to hack a vehicle from its owner. Tesla, on the other hand, has not publicly responded to explicit comments about this study, while the NCC Group provided a specific report about this vulnerability to the company. NCC Group received the official response that it did not actually pose a significant risk to their customers. Anyway the specialist, as a suggestion, advised Tesla that the best way to prevent these attacks would be to completely modify the unique keyless entry and start system.

This is not the first time we see Tesla vulnerabilities publicly exposed, as per various cybersecurity specialists; just a few days ago, David Colombo showed how to hijack certain functions of other cars, such as opening and closing their doors, or controlling the volume of the sound system. But this time, Sultan Qasim Khan went a step further and basically showed a level of total control of the vehicle in question.

This discovery was found through investigating security breaches on other devices, such as home access locks, which Mr. Khan specifies also have the same kind of problem. The cybersecurity expert carried out a demonstration for Bloomberg News, in which Khan himself performed a computer intrusion into a Tesla vehicle.

How to hack a Tesla: Sultan Qasim Khan reveals how to unlock, start and drive off with someone else's EV | Fortune https://t.co/9JoIzG5RzU— Russell Davis (@bentlightnvegas) May 20, 2022

Khan carried out this attack through the use of two small devices that act as electronically-operated remote switches. To do this, one of these devices was placed about 15 meters away from the vehicle owner's access card; the second device remained as a receiver, connected to a laptop located close to the electric car itself: just a few seconds later, the hacker had full control of the vehicle. These devices have been developed and designed by Sultan Qasim Khan himself, who actually sells them online for just under 50 dollars, while the complete system costs approximately 100 dollars.

You can see the full technical advisory article on this link: nccgroup.

All images courtesy of Tesla Inc.

Nico Caballero is the VP of Finance of Cogency Power, specializing in solar energy. He also holds a Diploma in Electric Cars from Delft University of Technology in the Netherlands, and enjoys doing research about Tesla and EV batteries. He can be reached at @NicoTorqueNews on Twitter. Nico covers Tesla and electric vehicle latest happenings at Torque News.