Teenage hacker takes control of more than 20 Teslas through a flaw in third-party software

A 19-year-old hacker claims to have taken over more than 20 Tesla vehicles in 10 countries through a software vulnerability.

David Colombo, who is based in Germany, shared the feat on Twitter saying the fault does not fall on the Elon Musk-founded company, but on owners of the Teslas.

The flaw is said to have been found in third-party software that allowed Colombo to unlock doors and windows, start the cars without keys and disable security systems.

He also tweeted the vulnerability lets him use the internal Tesla cameras to spy on the driver.

Colombo told DailyMail.com that 'it is not a vulnerability in Teslas infrastructure but indeed caused by the Tesla owners and a third party,' he said, confirming it is a third-party software that is at fault.

'I'm in contact with the Tesla Product Security Team as well as the third party maintainer to coordinate disclosure and get the affected owners notified as well as a mitigation/patch for the vulnerability rolled out.'

The issue with the software is how it stores the Tesla owner's information that is needed to link the cars to the program.

In the tweet thread, he states it is possible for him to remotely unlock the doors and start driving the Tesla.

However, he is unable to 'intervene with someone driving (other than starting music at max volume or flashing lights).'

Although Colombo has not provided details of the software, Twitter users are making their own guesses.

Tyler Corsair tweeted: 'These owners utilized an open-source project called Teslamate and then configured it incorrectly (partially the dev's fault for setting bad default configurations) so that anyone could access it remotely.'

Teslamate is a self-hosted data logger and visualization tool for your Tesla.

Corsair posted several updates from similar third-party software companies, stating they had seen Tesla accounts disconnect from the service - all of which was due to Colombo infiltrating the systems.

These include TezLab, TeslaFi, TeslaTip and keemut.

Corsair tweeted: 'This seems to not be impacting all installations (seems less likely if authenticated within the last few months) which is great! Many third-party services have been impacted by this in different ways. For most, just reconnecting your Tesla Account will resolve the issue.

He continued to explain in another tweet that Colombo's warning is not as dramatic as it may seem.

'This security researcher (@david_colombo_) appears to be over-hyping the severity of this issue just for follows, so pretty safe to disregard their thread,' Corsair tweeted.

Colombo told DailyMail.com in response to Corsair's tweet: 'I don't think I'm trying to make this look worse at it is.

'But I fully understand that there's a lot of hype and speculation around this due to the limited details I'm able to provide to the public at this point in the disclosure.'

He continued to explain that if it was not an issue than the Tesla Security team would not be investigating it.

'If my reports to the involved parties would not have some kind of severity then the Tesla Security Team would probably not investigate this issue, the third-party maintainer would probably not release patches in connection to this and tech / cyber security reporters with access to my writeup probably would not have reported on this issue in the way they do,' Colombo said in a direct message.

Reader Comments

Nada · 2022-01-14T00:30:00Z

ALL software has "backdoor" potential for being "hacked".

Danny Casolaro is a good start if you appreciate information like this. I "PROMIS".

Rowan Cocoan ·

Nada RIP. RC

· 2022-01-24T22:07:21Z

alexal60 ·

Like a simply JOKE

· 2022-01-14T14:27:38Z

alexal60 · 2022-01-14T14:31:51Z

On the night of January 14, hackers carried out a large-scale attack on numerous government websites in Ukraine.

The country's Center for Information Security of NAZI-UKRAINA, has already reported finding a Russian trace

However, such an obvious statement somehow dragged on for quite a long time.

The Center for Strategic Communications and Information Security said that, according to the study results, the first data give reason to believe that the attack was carried out by Russia.

The witty Ukrainian specialists have indicated the objectives of the attacks: the destabilization of the internal situation of the country (this is increasingly affirmed by the Ukrainian authorities, who fear the social revolt), as well as causing chaos and despair in society.

“Ukrainian Internet resources have not been attacked for the first or second time since the beginning of the Russian military aggression. Some cyber attacks have been so massive that they have entered the world's textbooks for cyberspecialists.

The purpose of such attacks is to destabilize the internal situation of the country, as well as to cause chaos and discouragement in society ", said the Center for Information Security.

“But such a massive attack on government agencies doesn't last long. We assume that the current one is related to Russia's recent defeat in negotiations on Ukraine's future cooperation with NATO.

Hacking actions against Ukrainian government agencies may also be part of this psychological attack on Ukrainians, " it was reported.

alexal60 · 2022-01-14T14:33:47Z

alexal60 Mass Formation Psychosis

alexal60 · 2022-01-14T14:39:03Z

in Ukraine, the number of state sites violated by unknown activists has increased.At the resources of the Ministry of Foreign Affairs, the Ministry of Education and Science, as well as agricultural and food policy, the websites of the State Emergency Situations Service , the Cabinet of Ministers of Ukraine and the Diya Electronic Service Service (an analog of the State Services) have been added. are trying to cope with the attack on the official websites of Ukrainian departments, but although their qualifications are insufficient, the resources are still inaccessible to users.UPDATED Large-scale cyber attacks on the resources of Ukrainian state institutions continue.By 15:00 : 00, the websites of the High Anti-Corruption Court (VAKS) and the Attorney General's Office of Ukraine, the portal of the judiciary and the unified register of judicial decisions do not work .... The website of the Government of Ukraine, the Ministry of Education, the Ministry of Foreign Affairs, the State Emergency Service and other non are still available.

Only the website of the Ministry of McDonald's of Ukraine was launched

Gator · 2022-01-14T17:15:38Z

Guess he gets a job at Tesla !

JTF Truth · 2022-01-14T19:57:21Z

More computers on cars mean more hackable cars. It's that simple. Don't think the government has already done this, think again.

These fires are not random bad luck or isolated failures. No doubt, and framing them as an attack on Christianity is rather convenient. No mention...

Psstoffgoy

How has this appalling harridan stayed at the top of the AFT for so long? I would assume it's a parasite jew, based on its actions it's a safe...

The Heidebad is part of a wider trend of European public pools tightening entry requirements in response to regional migration shifts. In other...

"Heavy Casualties" After Massive Twin Quakes Rock Venezuela, Topple Buildings; "International Response May Be Needed" June 24, 2026. Zero Hedge:...

parzival

You must give Trump that - he brings "Republicns" and "Democrats" back together ...

codis

Science & Technology

Teenage hacker takes control of more than 20 Teslas through a flaw in third-party software

Reader Comments

Latest News

Picture of the Day

Quote of the Day

Recent Comments

Quantum Quirk