Tesla Releases Urgent Security Patch After Model S System Hack

The update was released in response to a hack carried out by a cybersecurity firm last week, who found flaws in the car's security system which could allow hackers to take control of the vehicle.

Car manufacturer Tesla has released an over-the-air update for its Model S car, after cyber security experts exposed security flaws that would allow a hacker to take control of the vehicle. 

Security researchers Kevin Mahaffey, chief technology officer of Lookout, and Marc Rogers, principal security researcher at Cloudflare demonstrated the hack to delegates at the cyber security conference Def Con in Las Vegas on Friday.

At @_defcon_? Catch @dropalltables and @marcwrogers talk about hacking a #Tesla today at 2 http://t.co/pDUkpilT6y pic.twitter.com/TzWHwZ2Jql

— Lookout (@Lookout) 7 августа 2015

After physically connecting a computer to the car via an ethernet cable, they were then able to access certain systems in the car, and also install a Trojan horse allowing remote access.

The 'white hat' hackers, who carry out hacks in order to eventually improve security, said that they were motivated to try the hack on Tesla after reports of major security vulnerabilities in cars from Fiat Chrysler and GM. 

Miss the talk @_defcon_? Read about why @dropalltables and @marcwrogers hacked a #Tesla: http://t.co/UH6KIf0boS

— Lookout (@Lookout) 7 августа 2015

"My colleague Marc Rogers and I set out to audit the security of the Tesla Model S because we wanted to shine a light on a car that we hypothesized would have a strong security architecture, given the Tesla’s team’s deep software experience," explained Kevin Mahaffey.

"I really want to thank you guys. You're making the product better and safer," responded Tesla co-founder JB Straubel at the Def Con security conference, where the experts showed the audience how they carried out the hack.

Security expert Samy Kamkar hacked GM's OnStar in-vehicle system.

I've revealed OwnStar, a device that intercepts OnStar RemoteLink mobile app and can locate/unlock/remote start cars https://t.co/qRsjtLnRlM

— Samy Kamkar (@samykamkar) 30 июля 2015

In contrast to the over-the-air updates issued by Tesla and GM, last month Fiat Chrysler sent a USB stick to the owners of 1.4 million Jeep Chryslers with a software update to fix the cars' software problem, which allows hackers to wirelessly hijack the car. 

Though the Tesla hack was more difficult – the researchers had to physically access the Model S first – they found six security flaws which allowed them to access the vehicle's components. 

The vulnerabilities allowed them to leave behind a Trojan horse and gain access to the instrument cluster above the steering wheel, and the 17-inch touchscreen center information display in the middle of the dashboard, which they hackers were then able to use to remotely open and close the trunk, lock and unlock the doors and even start and stop the car.