We have seen the hacking of a Tesla car before, but this time a team of security researchers at a company called Promon managed to locate, unlock, and steal a car using only an Android application.
Every Tesla comes with a smartphone app for Android and iOS that allows owners to do basic things like check the battery level and charge status, locate the vehicle, and flash the lights to find it in a parking lot.
And while all of this is certainly very practical, it can also be used by hackers simply by breaching the Android app.
First of’ all is important to note that hacking cannot be done if the owners of Tesla cars have not downloaded and installed a malicious application on their Android phone. This is absolutely mandatory and is a reminder that if you care about your security simply do not download suspicious files.
In order to deceive Tesla owners into downloading the application, the hackers used a simple incentive such as a free hamburger.
Created a free and open Wi‑Fi hotspot near the Tesla charging station and advertised the app on phones connected to the station, claiming owners can get a free hamburger if they install the app.
Assuming the owner installed the malicious application, the hackers can connect to the phone and prepare the hijack. The way they hack the car is very simple, they simply force the owners to re-enter their username and password to essentially confirm their credentials and thus they steal them.
What comes next is not hard to imagine. Hackers, having full access to the Tesla app, can locate the car and unlock the car's keyless entry feature, which enables keyless driving.
What is also important to note is that this is not an issue of car vulnerabilities but of the mobile application. The researchers explain that this shows us the risks that objects controlled by smartphone apps have, and we recommend users to update the systems and applications and always avoid, always the download of applications that come from untrusted sources.
