Tesla returned as a sponsor at the Pwn2Own 2023 event, offering cash prizes and cars to white-hat hackers who could uncover security vulnerabilities in their vehicles. The Synacktiv team, a security company based in France, took up the challenge, which successfully hacked a Tesla Model 3, earning them $100,000 and the vehicle as a prize.
Tesla Takes Cybersecurity Seriously at Pwn2Own Event
The annual Pwn2Own hacker contest is known for its high stakes, and Tesla's involvement in the event demonstrates the company's commitment to cybersecurity. This year, the electric vehicle (EV) manufacturer brought a Model 3 and a Model S as targets for hackers. Tesla offered a top prize of $600,000 plus the car to any individual or team who could display a complex exploit chain leading to a complete vehicle compromise.
Synacktiv Demonstrates Complex Exploit, Earning Top Prize
The Synacktiv team rose to the challenge, executing a Time of Check to Time of Use (TOCTOU) attack against the Tesla Energy Gateway. This type of cybersecurity vulnerability occurs when an attacker exploits the small-time window between a resource's check and use, allowing unauthorized access or modification of the resource during that brief period.
This is the second year in a row that Synacktiv has successfully demonstrated an exploit in a Tesla Model 3 at the Pwn2Own event. Last year, they managed to exploit the vehicle's infotainment system, but the complexity of the hack was not enough to win the car. This year, however, their successful TOCTOU attack earned them $100,000 and the Model 3 and 10 Master of Pwn points.
Event Highlights Vehicle Security in a Connected World
Tesla's participation in Pwn2Own highlights the importance of vehicle security as EVs become more connected and sophisticated. As technology advances, so does the need for robust security measures to protect drivers, passengers, and cars from potential cyberattacks.
Tesla recently released how the company collects and uses information about its owners and drivers. It also instructed owners on how to get information the company has and how to delete it.
By inviting white-hat hackers to test their vehicles' security systems, Tesla can gather valuable information about potential vulnerabilities and develop stronger defenses for their cars. This proactive approach to cybersecurity sets a positive example for the automotive industry and demonstrates Tesla's commitment to maintaining the highest level of safety for its customers.
