French cybersecurity team wins a Tesla for hacking into one

Article content

In a little less than two minutes, a team of researchers from French cybersecurity company Synacktiv hacked into the infotainment and safety systems of a new Tesla Model 3. Don’t worry, it wasn’t anything nefarious—they did it at the annual Pwn2Own 2023 hacking conference in Vancouver, B.C., in mid-March. The team ended up winning US$250,000 for their efforts—along with a brand-new example of the car they hacked.

Article content

We apologize, but this video has failed to load.

Try refreshing your browser, or
tap here to see other videos from our team.

French cybersecurity team wins a Tesla for hacking into one Back to video

We apologize, but this video has failed to load.

Try refreshing your browser, or
tap here to see other videos from our team.

Play Video

Including prizes they won for hacking other issues throughout the event – they were named the top winners overall at the conference – Synacktiv eventually pocketed a total US$350,000, not including the new Tesla. The event is organized by Zero Day Initiative (ZDI), a subsidiary of a Japanese cybersecurity firm, which offers cash rewards to researchers who find security issues in products and programs. Over the three-day Pwn2Own conference, international teams discovered security breaches in such products as Adobe Reader, Microsoft SharePoint, Windows 11, and Apple macOS.

The team worked on the car’s head unit, which controls the infotainment and navigation systems. It would have been preferable to hack into the car itself, but organizers said they preferred to err on the side of caution for people or other cars around the vehicle being hacked, since the unit also controls the driving assist systems.

The team was given ten minutes and three chances to hack into the car. They first got into the infotainment system and replaced the Tesla logo with that of Synacktiv; and then got into the car’s systems entirely through Bluetooth.

ZDI said it reveals the hacking details privately to the software companies involved. It then gives the companies 90 days to develop and release patches to solve the issue; after that, it reveals the flaws publicly, whether or not the patches are available.

Article content

The electric-car company wasn’t just picked at random. According to ZDI, it partners with several automotive technology companies, and Tesla is a willing participant in the event — in fact, Tesla had its own security team at the event to validate the team’s hack. The automaker is said to be already working on a solution to the breaches found at the event.

In 2019, a team also successfully hacked into a Tesla, also winning the top spot in the conference and taking home the car. In 2022, competitors found vulnerable spots in Tesla’s infotainment system. ZDI said that Tesla is its “single largest target” in the Pwn2Own conference since it “almost singlehandedly invented the connected car industry,” and “knows more than most what’s required to keep one step ahead of the competition and the cybercrime community,” which includes continually looking for software bugs.