Tesla Model 3 hacked within two minutes in 'hackathon' contest

A team of French cybersecurity researchers have exploited a Tesla Model 3’s critical systems twice at the Zero Day Initiative’s Pwn2Own annual hacking contest in Vancouver.

These events are also known as 'hackathons' and are commonly run as a 'whitehat' security exercise to help identify vulnerabilities that might otherwise be exploited by bad actors.

The Synacktiv team gained access the electric vehicle within two minutes by executing a time-of-check-to-time-of-use (TOCTTOU) attack on Tesla's Gateway energy management system.

It allowed them to remotely open the frunk (front storage) while the vehicle was driving – and were rewarded with $149,300 (US$100,000) and a new Model 3 sedan for discovering the tier-three vulnerability.

2

In the second hack, Synacktiv researchers exploited a heap-overflow vulnerability and an out-of-bounds write error in an external Bluetooth chipset to access Tesla’s infotainment system and subsequently gain root access to other deeper subsystems.

They were rewarded an additional $373,200 (US$250,00) bounty as the contest’s first-ever attack classified as a tier-two level – which is reversed for particularly impactful vulnerabilities and exploits.

Due to the risk of hacking a vehicle, the team demonstrated their exploits on a separated Tesla head unit and componentry – which is the home to nearly all of the vehicle’s controls, including the speedometer, adjusting the mirrors, and opening the glovebox.

In total, participants in the three-day hacking contest discovered 27 unique zero-day vulnerabilities, including in Microsoft SharePoint, Teams and the Windows 11 operating system, with the Trend Micro-owned organisation giving out $1.5 million (US$1.03 million).

Unlike other carmakers, Tesla recently published its data privacy policy, stressing its high-tech EVs mostly localise and anonymise data collection.

Major car brands are increasingly becoming ‘software-driven’ technology companies by investing in their own operating systems, while others such as Volvo, Polestar and Renault adopt built-in systems from tech giants such as Google’s Android Automotive and the forthcoming next-generation Apple CarPlay.