The popular security expert Troy Hunt discovered a security vulnerability affecting the API implemented by Nissan to manage the LEAF cars from a mobile device. Other experts have confirmed the existence of the flaw, the vulnerability had been discussed publicly on a French-language forum since December.The vulnerability could be exploited by hackers to remotely manage some features of the popular electric car.
The vulnerability could be exploited by hackers to remotely manage some features of the popular electric car.
Nissan provided both Android and iOS applications to remotely manage the vehicle from a mobile device.
Hunt was at a workshop held Norway when one of his students owning a Nissan LEAF reported that the app for iOS was using only the Vehicle Identification Number (VIN) to authenticate users. The knowledge of the Nissan LEAF’s VIN could allow attackers to control air conditioning and access driving data, including power consumption and travel distance.
The analysis of the API revealed the possibility to access them without any kind of authentication.
Hunt conducted a series of tests with the support of the researchers Scott Helme that demonstrated how to take control of the vehicle remotely. An attacker could exploit the flaw to turn on the AC of a parked car draining its battery, but the Australian expert Troy Hunt confirmed that it is not possible to remotely control the engine neither lock or unlock the vehicle.
How to obtain a target’s VIN?
Hunt explained that all the Nissan LEAF vehicles he analyzed have the same VIN, except for the last five digits. An attacker can try all possible combinations of these digits to send commands to the vehicle.
Hunt reported the issue to Nissan on January 23, but a vulnerability is still unpatched. Waiting for the fix, users can disable the service from the configuration menu.
(Security Affairs – Nissan Leaf, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.