Nissan yanks remote-access Leaf app -- 4+ weeks after researchers report critical flaw

[Read the post]

This gladhands the idiocy at play here–there was no auth in the connect strings to enable this at all. NONE. Uniqueness in the request was only done by sending the VIN (in plaintext, mind you, that’s how the hack was found). The VIN, which, by law, must be visible through the windshield. So, you snoop your network for the GET command when fiddling with your own Leaf (or a friend’s), see the command structure, change the VIN and Bob’s your uncle. Fucking idiotic.

This isn’t an Internet of Things concern, this is a piss poor understanding or interest in even the most rudimentary concerns about IT security. This is “password123” level nonsense.


Since the Leaf is an electric car, draining the battery is a much bigger deal than draining the battery of an ICE car. The victim would likely need a tow rather than a simple jumpstart. I’m not even sure the Leaf can be charged with a normal extension cord, it might need its special charger.


1 Like

Cool car, really slick design!


Are you saying that my MAC address based ‘intuitive authentication’ concept might not be ready for IPO?


I own a Leaf.

The car comes with a charger that can be plugged into a standard 120 volt outlet, which you could use with an extension cord, if that cord was heavy duty enough. Though, I think if the battery was remotely drained, you wouldn’t be near a power outlet anyhow. You would certainly need a tow. (Funny thing, the car comes with a front tow hitch for just this reason.)

It takes 24 hours to charge from 0% to 100% on the 120 volt charger. A level 2 charger, which operates on a 240 volt outlet, takes about 5 hours. If it was already plugged in, then the remote hack would be fairly pointless.


This topic was automatically closed after 5 days. New replies are no longer allowed.