Millions of digital locks worldwide, including on Tesla Inc. cars, can be remotely unlocked by hackers exploiting a vulnerability in Bluetooth technology, a cybersecurity firm said on Tuesday.
In a video shared with Reuters, NCC Group researcher Sultan Qasim Khan was able to open and then drive a Tesla Inc. using a small relay device attached to a laptop which bridged a large gap between the Tesla Inc. and the Tesla Inc. owner’s phone.
“This proves that any product relying on a trusted BLE connection is vulnerable to attacks even from the other side of the world,” the UK-based firm said in a statement, referring to the Bluetooth Low Energy (BLE) protocol – technology used in millions of cars and smart locks which automatically open when in proximity to an authorized device.
Although Khan demonstrated the hack on a 2021 Tesla Inc. Model Y, NCC Group said any smart locks using BLE technology, including residential smart locks, could be unlocked in the same way.
Tesla Inc. did not immediately respond to a request seeking comment.
NCC Group said such a vulnerability was not like a traditional bug which could be fixed with a software patch and added BLE-based authentication was not originally designed for use in locking mechanisms.
“In effect, systems that people rely on to guard their cars, homes and private data are using Bluetooth proximity authentication mechanisms that can be easily broken with cheap off-the-shelf hardware,” the firm said.
“This research illustrates the danger of using technologies for reasons other than their intended purpose, especially when security issues are involved.”
Be smart with your money. Get the latest investing insights delivered right to your inbox three times a week, with the Globe Investor newsletter. Sign up today.