≡ Menu

Teenager Takes Control of 25+ Teslas: It’s probably nothing to worry about…


So, I now have full remote control of over 20 Tesla’s in 10 countries and there seems to be no way to find the owners and report it to them…

Since these important facts seem to drown between other comments, I‘ll add them here again 👇

This is not a vulnerability in Tesla‘s infrastructure. It‘s the owners faults. That‘s why I would need to report this to the owners as stated above.

Nevertheless I now can remotely run commands on 25+ Tesla‘s in 13 countries without the owners knowledge.

Regarding what I‘m able to do with these Tesla‘s now.
This includes disabling Sentry Mode, opening the doors/windows and even starting Keyless Driving.

I could also query the exact location, see if a driver is present and so on. The list is pretty long.

And yes, I also could remotely rickroll the affected owners by playing Rick Astley on Youtube in their Tesla‘s😂

I think it‘s pretty dangerous if someone is able to remotely blast music on full volume or open the windows/doors while you are on the highway.

Even flashing the lights non-stop can potentially have some (dangerous) impact on other drivers.

That‘s why I would like to get this all fixed before I release any specific details regarding what exactly this all is about.

Next steps:
– Waiting for MITRE‘s reply regarding a CVE
– Preparing my Writeup
– Coordinating disclosure to affected owners with Tesla

Small addition (for media reporters):

As already stated in some other replies, it is not “full remote control” as in being able to remotely control steering or acceleration & braking.

Yes, I potentially could unlock the doors and start driving the affected Tesla‘s.

No I can not intervene with someone driving (other than starting music at max volume or flashing lights) and I also can not drive these Tesla‘s remotely.

Addition as of 11. Jan 22:33 (CET)

Tesla‘s Security Team just confirmed to me they’re investigating and will get back to me with updates as soon as they have them.

The MITRE CVE Assignment Team reserved a CVE for it.

Comments on this entry are closed.

  • KCK January 14, 2022, 8:15 AM

    Put this down as one more reason I will never love the coal powered car.

  • gwbnyc January 14, 2022, 8:22 AM

    I haven’t owned a car for decades. I’ll buy one this year and it’s going to be a Super Beetle.

  • Richard January 14, 2022, 8:26 AM

    Just one more reason, among many, that I hope to hold onto my “dumb” 2001 Accord until I can no longer drive.

  • Mike Austin January 14, 2022, 8:31 AM

    All vehicles since 2015 or earlier can be hacked. That is, somebody, some government agency or some rando high-IQ computer geek can remotely—and this is the key: remotely—take control over your vehicle. This was probably behind the death—the “cyber-assassination”—of Michael Hastings.

    “Richard Clarke, the counterterrorism chief under both Bill Clinton and George W. Bush, told the Huffington Post that Hastings’s crash looked “consistent with a car cyber attack….What did he mean? According to Stefan Savage, a computer science professor at the University of California, San Diego, any modern vehicle’s computer system made by any manufacturer can be hacked.”

    See this video. All is explained.

    https://www.youtube.com/watch?v=3jstaBeXgAs&t=587s

    Think about this the next time you get into your car. I have no car, only bicycles. You cannot hack a machine that runs on muscle rather than fancy code and computer chips.

  • Dirk January 14, 2022, 9:03 AM

    Hacked, not if you don’t play the game. We’ll electric vehicles. Now I DID order a new truck yesterday. A Ford F-350 which is six months to nine months out. Go figure. We learned that it was Chevy and GMC who were experiencing chip related delays. Fords just that far behind via high sales numbers.

    Was in a town nicknamed “ TallTown yesterday. Lakeview OREGON, The highest town in OREGON at 4950 ft. They have a county/ city ordinance “number 854 “, in which it is lawful to ride or drive dirt bikes, three wheelers Quads and side by sides on all City streets and county streets and roads.

    The driver of such vehicles CAN cross state highways, but cannot drive on state highways.

    I recovered a copy of the above ordinance yesterday. Gas and diesel here are pushing 4.00 dollars, the local news reports well see 5.00 plus in the Biden’s election cycle.

    I’m headed to city police the sheriffs office and the state police today to seek support to pass such an ordinance here in our county.

    I spent the morning, faxing copies to our state representatives for review and support.

    “ Gotta do the political stuff behind closed doors” over the years I’ve learned to win hearts and minds. Elected or appointed folks have in this ordinance an opportunity to win the support of locals for not dropping gas prices, that’s not in their wheel house, but to arrange for folks to achieve major savings within the county by NOT having to drive their gas guzzling vehicles to and from local shopping trips.

    Like to ask you friends to share your thoughts. Pro/con. I’ve learned with the depth of intellect here, I’ll learn “how to” be more effective in my presentation. This is for the good of my community I think, and it does not have to be MY way.

    Dirk Williams

    before I’ll seek floor time at a coming commissioners meeting to introduce the exact ordinance used in the county to our east.

    • John Venlet January 15, 2022, 8:12 AM

      Dirk, your mention of a new ride being purchased compels me to share my new vehicle purchase story, which took place over the past week.

      My Lovely Melis had a 2019 VW Tiguan, we owned it free and clear, with a mere 16K miles on it. She didn’t really like the car, so we decided to sell it. Went to the Carmax and Carvana websites and entered the data on the vehicle. They offered us crazy money for the car. $30,800.oo, sight unseen. Went to their local brick and mortar that day, and an hour later she walked out with a check for $30,800.00. When she got in my truck, a 2013 Ram Laramie with 101K miles, which I had been planning to drive til the wheels fell off, she tells me I should see what Carmax or Carvana would offer for my truck. So I did. Entered my truck’s particulars, which was in fair to good condition being 9 years old, and they offered me $22,800.00. I took it. So now we’ve got $53,600 cash in our pockets, but only my ’82 Jeep to drive, so I get online to search the area for another Ram 1500 Laramie. There are 3 dealers close by with a limited selection, but I find a Ram 1500 Longhorn Limited, loaded up, available and make a call to the dealer to see if they’ll wrangle, and they do. So I’m driving a brand spankin’ new Ram, and only had to throw a few more $K at it to own it. The Lovely Melis may lease something in the future, but we really don’t need to. Carmax and Carvana are paying crazy money for used vehicles. It blows my mind. My brother, after hearing my story, checked out Carmax for a loaded up Toyota Land Cruiser, 2021, he owned, and they paid him $5K over what he paid for it last year, with 18K more miles on it. Crazy!

      The only bad part of this experience, in my eyes, was the delivery of the Ram. Prior to being able to drive it off the lot, the dealer was required to link my phone to Apple, Google, and Ram’s own app for the vehicle, which did not make me happy. So, after I got the truck home and in my driveway, I immediately deleted the Ram app, and the links to Apple and Google. I’m not a tech phobe, but I do not want those crap apps on my phone or truck.

      I’m tellin’ ya, if you own a newer model used vehicle, right now you can get stupid crazy money for them from Carmax or Carvana.

      • Dirk January 15, 2022, 4:42 PM

        John awesome story. I enjoy things such as your experience. Good people should have good deeds happen for them.. congratulations.

        Dirk

  • Anonymous January 14, 2022, 10:33 AM

    When things get crazy, Americans find a way around it. My newest car is a 1966 Chrysler. I have enough running driving cars to last the rest of my life. During the gas crunch of 1973 I filled my cars and drained some out whenever I needed for the motorcycle, my main use of transportation. Bring it on Biden. America knows how to survive your crap

    • Klaus January 14, 2022, 4:39 PM

      You nailed it. I’ve got the same thing going sorta,my daily driver is 61 f-100. Everything I drive has points.