This gladhands the idiocy at play hereâthere was no auth in the connect strings to enable this at all. NONE. Uniqueness in the request was only done by sending the VIN (in plaintext, mind you, thatâs how the hack was found). The VIN, which, by law, must be visible through the windshield. So, you snoop your network for the GET command when fiddling with your own Leaf (or a friendâs), see the command structure, change the VIN and Bobâs your uncle. Fucking idiotic.
This isnât an Internet of Things concern, this is a piss poor understanding or interest in even the most rudimentary concerns about IT security. This is âpassword123â level nonsense.
Since the Leaf is an electric car, draining the battery is a much bigger deal than draining the battery of an ICE car. The victim would likely need a tow rather than a simple jumpstart. Iâm not even sure the Leaf can be charged with a normal extension cord, it might need its special charger.
Cool car, really slick design!
Are you saying that my MAC address based âintuitive authenticationâ concept might not be ready for IPO?
I own a Leaf.
The car comes with a charger that can be plugged into a standard 120 volt outlet, which you could use with an extension cord, if that cord was heavy duty enough. Though, I think if the battery was remotely drained, you wouldnât be near a power outlet anyhow. You would certainly need a tow. (Funny thing, the car comes with a front tow hitch for just this reason.)
It takes 24 hours to charge from 0% to 100% on the 120 volt charger. A level 2 charger, which operates on a 240 volt outlet, takes about 5 hours. If it was already plugged in, then the remote hack would be fairly pointless.
This topic was automatically closed after 5 days. New replies are no longer allowed.
