Tesla Motors Inc (NASDAQ:TSLA) had to roll out an over-the-air fix after Chinese researchers working for Tencent Holdings Ltd (OTCMKTS:TCTZF) exploited the Model S through a security flaw in its internet connection.
Keen Security Lab of Tencent was reportedly able to remotely control the Tesla Model S to a limited extent, operating its moonroof, trunk, seats and touchscreen, and even engaging the brake from 12 miles away.
In the blog post demonstrating the “attack,” Tencent prefaced the video by pondering the impact of information security issues when autonomous cars take to the roads en masse.
According to one researcher in the video, multiple varieties of the Tesla Model S are capable of being remotely controlled. The hack is performed by breaking into Tesla’s CAN bus, an onboard computer system.
The only catch was that the Model S had to have been started at least once prior to hacking it. That’s because the Tesla, when using its internet connection to search for nearby charging stations, leaves itself vulnerable to hackers with know-how.
From the blog post by Keen Security:
“Following the global industry practice on ‘responsible disclosure’ of product security vulnerabilities, we have reported the technical details of all the vulnerabilities discovered in the research to Tesla. The vulnerabilities have been confirmed by Tesla Product Security Team.”
“It is reasonable to assume,” the blog post continues, “that other Tesla models are affected.”
Tesla responded to this by calling it a low-risk threat and saying that attackers could only take control of a Tesla Model S when it was in range of “malicious” WiFi. While the patch was issued to affected Tesla models a day after Keen Security’s blog post went live, it took a total of 10 days to patch from when Tesla first learned about the exploit.
“Our realistic estimate is that the risk to our customers was very low, but this did not stop us from responding quickly,” said Tesla in a statement.
As of this writing, John Kilhefner did not hold a position in any of the aforementioned securities.
