A Tesla Model 3 was hacked in less than two minutes at Pwn2Own hacking contest at Vancouver. Researchers from France’s Synacktiv demonstrated two separate exploits against the Model 3 during the competition.
Synactiv researchers were able to make access into subsystems that control the vehicle’s safety and other components. More specifically, one of the exploits involved executing a so-called TOCTTOU (time-of-check-to-time-of-use) attack on Tesla’s Gateway energy management system.
For their second hack, Synacktiv researchers broke into Tesla’s infotainment system by exploiting a heap overflow vulnerability and an out-of-bounds write error in a Bluetooth chipset. In doing so, they were able to gain root access to other subsystems.
“The biggest vulnerability demonstrated this year was definitely the Tesla exploit. They went from what’s essentially an external component, the Bluetooth chipset, to systems deep within the vehicle,” said Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative (ZDI), which organizes the annual contest.
