Get All Access for $5/mo

Researchers Find a Clever Way to Hack Into and Steal Your Tesla They did it with a simple $169 hacking tool.

By Grace Eliza Goodwin

Key Takeaways

  • Hackers have a potential new way to steal your Tesla.
  • Researchers created a fake Tesla WiFi network to steal the owner's login info and set up a new phone key.
  • Teams have previously found other hacking vulnerabilities in the high-tech Teslas.
Kena Betancur/Getty Images via Business Insider.
Two researchers found a way to use social engineering to potentially steal Teslas parked at charging stations.

This article originally appeared on Business Insider.

If you own a Tesla, you might want to be extra careful logging into the WiFi networks at Tesla charging stations.

Security researchers Tommy Mysk and Talal Haj Bakry of Mysk Inc. published a YouTube video on Thursday explaining how easy it can be for hackers to run off with your car using a clever social engineering trick.

Here's how it works.

Many Tesla charging stations — of which there are over 50,000 in the world — offer a WiFi network typically called "Tesla Guest" that Tesla owners can log into and use while they wait for their car to charge, according to Mysk's video.

Using a device called a Flipper Zero — a simple $169 hacking tool — the researchers created their own "Tesla Guest" WiFi network. When a victim tries to access the network, they are taken to a fake Tesla login page created by the hackers, who then steal their username, password, and two-factor authentication code directly from the duplicate site.

Although Mysk used a Flipper Zero to set up their own WiFi network, this step of the process can also be done with nearly any wireless device, like a Raspberry Pi, a laptop, or a cell phone, Mysk said in the video.

Once the hackers have stolen the credentials to the owner's Tesla account, they can use it to log into the real Tesla app, but they have to do it quickly before the 2FA code expires, Mysk explains in the video.

One of Tesla vehicles' unique features is that owners can use their phones as a digital key to unlock their car without the need for a physical key card.

Once logged in to the app with the owner's credentials, the researchers set up a new phone key while staying a few feet away from the parked car.

The hackers wouldn't even need to steal the car right then and there; they could track the Tesla's location from the app and go steal it later.

Mysk said the unsuspecting Tesla owner isn't even notified when a new phone key is set up. And, though the Tesla Model 3 owner's manual says that the physical card is required to set up a new phone key, Mysk found that that wasn't the case, according to the video.

"This means with a leaked email and password, an owner could lose their Tesla vehicle. This is insane," Tommy Mysk told Gizmodo. "Phishing and social engineering attacks are very common today, especially with the rise of AI technologies, and responsible companies must factor in such risks in their threat models."

When Mysk reported the issue to Tesla, the company responded that it had investigated and decided it wasn't an issue, Mysk said in the video.

Tesla didn't respond to Business Insider's request for comment.

Tommy Mysk said he tested the method out on his own vehicle multiple times and even used a reset iPhone that had never before been paired to the vehicle, Gizmodo reported. Mysk claimed it worked every time.

Mysk said they conducted the experiment for research purposes only and said no one should steal cars (we agree).

At the end of their video, Mysk said the issue could be fixed if Tesla make physical key card authentication mandatory and notified owners when a new phone key is created.

This isn't the first time savvy researchers have found relatively simple ways to hack into Teslas.

In 2022, a 19-year-old said he hacked into 25 Teslas around the world (though the specific vulnerability has since been fixed); later that year, a security company found another way to hack into Teslas from hundreds of miles away.

Want to be an Entrepreneur Leadership Network contributor? Apply now to join.

Editor's Pick

Operations & Logistics

The Holidays Mean Vacation Time — But Disaster Can Still Strike. Is Your Crisis Plan Ready?

Holidays mean different working hours for companies and different schedules for employees that take off. Before you and your team enjoy some much deserved time off, it is important to put a crisis management plan in place so your business is ready to tackle any issue that crops up.

Business News

Here's What the CPI Report Means for Your Wallet, According to JPMorgan and EY Experts

Most experts agree that there will be another rate cut next week.

Business Solutions

Right Now, You Can Get More Than 310 Hours of IT Training for Just $50

Stay ahead in tech with the CompTIA Super Bundle.

Leadership

3 Ways Your Parenting Skills Can Improve Your Leadership Skills

Parenting and management offer valuable lessons in identifying talent, nurturing potential and fostering growth through encouragement and guidance.

Starting a Business

How to Start a Freight Brokerage Business

Get your entrepreneurial destiny really moving by becoming a broker--matching shippers and transportation servicess--for the freight industry.