Tesla has issued a security update to its Model S car after security researchers discovered six flaws that allowed them to control its entertainment software and hijack the vehicle.
With access to the entertainment software, Kevin Mahaffey, CTO of security startup Lookout, and Marc Rogers, a security researcher at CloudFlare, turned off the engine while a person was driving, changed the speed and map information displayed on the touchscreen, opened and closed the trunk and controlled the radio.
The pair, who will discuss their findings Friday at the DEF CON hacking conference in Las Vegas, also uploaded a remote access application that allowed them to lock and unlock the car using an iPhone.
Mahaffey stressed in an interview that physical access to the car was needed to carry out the hack. For their research, he and Rogers plugged a laptop into a Model S ethernet port and exploited the vulnerabilities until they tapped into the entertainment software. They didn’t provide details on what flaws were used in their hack.
Any software program can be hacked and the assumption is hackers will be able to eventually remotely attack a car’s entertainment applications, Mahaffey said. Keeping this in mind, he and Rogers looked at how to secure a car after it has been compromised.
It’s impossible to prevent an attack from hitting a car’s computer system, Mahaffey said.
“The question is how do you respond quickly with a patch and how you do you make your car resilient,” he said.
One way to bolster a car’s security is by increasing the protection around individual components, and that way preventing a hacker from using one compromised system to access another.
Tesla was lacking in this area, Mahaffey said, adding that the company’s recent security update should help rectify the problem.
“We should make sure that if you hack the infotainment system, you shouldn’t be able to get access to the drive system,” he said.
On Thursday, a spokeswoman for the Palo Alto, California, car maker confirmed it issued a patch for the flaws discovered by Mahaffey and Rogers. The company uses an over-the-air system to update its vehicles’ software.
Mahaffey would like other automotive manufacturers to fix security flaws by delivering updates over the air, instead of slower, traditional mass repair methods like recalls.
“Your car today has more in common with a laptop than a Model T,” he said, adding that cars will need to be patched more quickly than a piece of computer hardware.
Mahaffey and Rogers selected Tesla because the company is known for building technologically sophisticated cars.
Car security has grown in importance as vehicles have gained Internet access and applications that turned them into computers on wheels. In July, hackers demonstrated they were able to hack into a Jeep Cherokee and reduce the vehicle’s speed while a person drove it. U.S. legislators have taken an interest in this issue and have proposed regulations that would force manufacturers to better protect vehicles from hackers.