Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

I'm smelling bull on this story

This site may earn commission on affiliate links.
Here's a question for you.

There's much scepticism on this thread about whether or not the car was properly locked. Yet it occurred to me this morning that the M3 door lock isn't a deadlock. You can - in theory - open a M3 door by hooking a straightened coat hanger under the manual opener handle and pulling it up, from the outside, by pushing the wire between the window glass and rubber. I doubt it would take an experienced thief more than a few seconds.

Not that I'm willing to test this!
 
In this case since the car will be locked the moment you open the door the alarm should get going.
Agreed. And it's damned noisy, too - according to daughter #2 who got traumatised when I left her in the car while I went to get a burger. Alarm went off with her inside it (she's 19 and was listening to music on her phone).
 
  • Like
Reactions: candida
same - about 1m away it locks.

I turn off the walk-away door lock when I wash my car as otherwise it will lock on me simply because I'm around the back of the car. Folds in those wing mirrors, means it has to unlock if I open the doors and messes up my cleaning regime. So yeah, it's definitely a close range thing.
 
Last edited:
There's a level of defecation to this story for sure. Why is he so blasé? I'm sceptical. tesla pay GOOD dividends to people to prove they can hack a car, which leads me to believe this person wasn't hacking their way in. Either the car was permanently unlocked somehow, perhaps as others have said bluetooth / keyless? OR this mystery person had a keycard somehow. No idea.

Wouldn't happen at our place. The proximity alarms would be going nuts, and CCTV would capture the whole thing. You'd think some one like this would have some kind of basic home security.

Something aint right here!
In other news, he discovers his daughter has had trouble sleeping at night, but fails to connect the dots...
 
It's either totally made up, or he lost a keycard, or his daughter didn't want him to know she was sticking cocaine up her nose.

Considering there's been no followup on his twitter for days (and really if this was true wouldn't you be expending a lot of energy finding out what happened?) I'm going with the first option.
 
A good trick for washing that I learned thanks to Mr H is to leave the phone inside the house and unlock the car with the card. It then stays unlocked, mirrors unfolded and I can happily wash it with no trouble.
Only problem is that if I press the charging port while moving around the sponge it pops open ;) Oh well
isn't there a car wash mode for that stuff now?
 
  • Like
Reactions: Adopado
The actual vulnerability story has some truth.

One example here:


Tesla expired a fair few authentication tokens for some using third party apps/services.

It appears to be tokens generated using a v2 API version revoked, because that's the only easy and quick clue Tesla have that someone may have been hosting a vulnerable application. But also and more importantly, it's really a vulnerability in how some were self hosting the 3rd party service


It does always highlight that security is end to end, who and what do you trust with access.

However at the time of the original story behind this thread, this vulnerability wasn't disclosed anyway. Not that it was related anyway.
 
Regarding washing the car, just leave your phone on the driver's seat. I found it prevents the car from locking.

Regarding 3rd party apps and vulnerabilities, I've always suspected the app makers of being sloppy, so when I wanted to access better data on my car (for fun, I have no real reason to do it as I'm not a data scientist) I put TeslaMate on a rPI and ran it on my local net with no external access. Strictly speaking it is less secure than not running it at all, but it's sitting behind a firewall on a reasonably well maintained (that is, "updated") router / network, so I'm as safe as I can be.
 
The actual vulnerability story has some truth.

One example here:


Tesla expired a fair few authentication tokens for some using third party apps/services.

It appears to be tokens generated using a v2 API version revoked, because that's the only easy and quick clue Tesla have that someone may have been hosting a vulnerable application.

Ah, well that would explain why my API scripts suddenly stopped working at exactly 06:30 UTC yesterday. They all suddenly started returning no data.

Gotta create a new access token then? I guess refreshing an existing access token using the refresh token won't work?