After a rented Tesla Cybertruck caught fire outside the Trump International Hotel in Las Vegas, Tesla’s advanced data systems became a focal point in the investigation. The explosion, which resulted in a fatality, initially raised concerns about electric vehicle safety. However, Tesla’s telemetry data revealed the incident was caused by an external explosive device, not a malfunction in the vehicle.
Tesla’s telemetry systems played a key role in retracing the Cybertruck’s travel route from Colorado to Las Vegas. Las Vegas Sheriff Kevin McMahill confirmed that Tesla’s supercharger network provided critical data about the vehicle’s movements, helping investigators identify its journey.
Modern Tesla vehicles are equipped with sensors, cameras, and mobile transmitters that continuously send diagnostic and location data. While this information is typically encrypted and anonymized, Tesla’s privacy policy allows for specific data access during safety-related incidents, such as video footage and location history.
Tesla CEO Elon Musk confirmed that telemetry data indicated the vehicle’s systems, including the battery, were functioning normally at the time of the explosion. The findings also linked the incident to a possible terror attack in New Orleans earlier the same day, further emphasizing the value of Tesla’s data in broader investigations.
Tesla vehicles offer features like Sentry Mode, which acts as a security camera when parked. This feature has been instrumental in prior investigations. For example:
Such data-sharing capabilities demonstrate the role of modern vehicles in aiding law enforcement.
While Tesla’s data-sharing has been beneficial, it has also raised concerns among privacy advocates. In 2023, the Mozilla Foundation criticized the automotive industry for collecting excessive personal information, naming Tesla as one of the top offenders. Critics argue that this extensive data collection, while helpful in solving crimes, poses risks to individual privacy.
Data collected by Tesla vehicles includes:
This data is essential for developing autonomous driving software but can also be accessed during emergencies. For example, vehicles automatically transmit accident videos and provide location details during crises.
The Las Vegas explosion highlights the dual nature of connected vehicles: they provide invaluable tools for law enforcement while sparking debates about data privacy and security. As cars become increasingly data-driven, the challenge lies in balancing public safety with individual privacy rights.
Electric vehicle (EV) technology is developing quickly, and a new group of tech aficionados called EV hackers is forming. These people want to investigate the latent possibilities of electric automobiles, not steal cars or undermine security systems. These creative minds have turned the world of EVs into a playground, adjusting performance and revealing hidden features.
The popularity of EVs has increased interest among tech-savvy people, according to a recent post on Wealth of Geeks. They view electric cars not only as a means of mobility but also as a cutting-edge technological marvel with limitless personalization options. The writer contends that "EVs represent a convergence of transportation and cutting-edge technology, and this fusion inevitably attracts hackers and tech enthusiasts."
The depth of potential within this subject was shown during an intriguing presentation at the Black Hat conference. The discussion, "Jailbreaking an Electric Vehicle: Or What It Means to Hotwire Tesla's X-Based Seat Heater," covered the intricate details of hacking electric vehicles' software. The presentation demonstrated the opportunity for personalization and modification inside the EV space without endorsing any unlawful activity.
Pushing the limits of EV technology is another area of current research at IIT CNR. Their efforts are directed toward bettering the performance and functionality of electric vehicles by comprehending and altering the underlying software. This study not only adds to the body of expanding knowledge in the area, but it also provides motivation for other tech aficionados.
Dr. Maria Rossi, a lead researcher at IIT CNR, emphasized, "Electric vehicles are not just cars; they are complex computer systems on wheels. There is so much potential to optimize and enhance their capabilities, and this is what drives our research."
While the idea of hacking may carry negative connotations, in the world of EVs, it simply means exploring the uncharted territories of electric vehicle technology. These enthusiasts are driven by a passion for innovation and a desire to unlock the full potential of electric vehicles.
The vulnerabilities were found by experts working for SaiFlow, a company based in Israel that specializes in defending EV charging infrastructure and distributed energy resources.
The security loopholes are linked to the communications between the charging system management service (CSMS) and the EV charge point (CP), especially using the Open Charge Port Protocol (OCPP). The loopholes are believed to affect the CSMS offered by various vendors.
The issue is associated with the use of WebSocket communications by the OCPP and how it handles multiple connections poorly. The protocol lacks knowledge about handling more than one CP connection at a time and threat actors can abuse this by opening a new connection to the CSMS. Another problem is related to what SaiFlow explains as a "weak OCPP authentication and chargers identities policy."
By opening a new connection to the CSMS on behalf of a charge point, the threat actor can impact the original connection to be shut down or become non-functional.
As per SailFlow, a threat actor can misuse the loopholes to deploy a distributed denial of service (DDoS) attack that destroys the electric vehicle supply equipment (EVSE) network.
Besides this, if a threat actor can connect to CSMS, they may be able to get drivers' personal information, this includes payment card data, along with other sensitive data like server credentials.
Ron Tiberg-Shachar, co-founder and CEO of SaiFlow said "in particular configurations, if the charger approves unfamiliar driver identities, an attacker can manage to charge their vehicle without paying for it. Since the CSMS platforms are publicly accessible, it is possible for an attacker to hijack the connection remotely, without needing to gain credentials, access, or perform MITM attacks." Tiberg believes that it may be possible for an amateur hacker to launch an attack, even with scarce resources.
To conduct an attack, the hacker first needs to get a charger's identity. This identity generally has a standard structure, making it easier for hackers to enumerate the values of valid identifiers.
In the next stage, they need to get info on which CSMS platform the charger is connected to. According to experts, the CSMS URL can be found using services like Shodan or SecurityTrails.
SailFlow has made a technical blog post explaining the vulnerabilities and the attack scenarios. The company also gave recommendations for how these kinds of attacks can be controlled. It seems unlikely that vendors can easily patch the vulnerabilities.
Tiberg said, "we’ve approached many key players in the industry (and keep on doing so) to make them aware of our findings and how they can approach a solution. Additionally, we’ve made our solutions team available to support any specific technical questions, in an effort to reinforce vulnerabilities as quickly as possible. Our key goal is to support partners in scaling their charging infrastructure as quickly and safely as possible."