'Small stickers' were enough to trick a Tesla's autopilot to drive into the wrong lane

By placing three stickers over road markings, researchers caused the Tesla to move to the wrong side of the road.

A security vulnerability in Tesla firmware made it possible for outsiders to take remote control over a vehicle’s steering and push it into an opposite lane, according to recent research from Tencent’s Keen Security Lab.

The computer experts discovered that, by painting “small stickers” on a roadway, they could fool the autopilot on a Tesla Model S 75 into following a path the driver did not intend. The technique exploited the car’s autopilot protocol, which quickly collects data about a vehicle’s surroundings based on radar signals, cameras and other sensors. By placing stickers over road markings, the Keen team caused the Tesla to move to the wrong side of the road.

Researchers also proved it was possible to activate the windshield wipers by using a camera to trick the Tesla’s artificial intelligence into believing there was moisture on the surface.

Tesla fixed the “primary” flaw with a series of security patches issued in 2017 and 2018, “both of which we released before this group reported this research to us,” a company spokesperson said in an email to CyberScoop.

“The rest of the findings are all based on scenarios in which the physical environment around the vehicle is artificially altered to make the automatic windshield wipers or Autopilot system behave differently, which is not a realistic concern given that a driver can easily override Autopilot at any time by using the steering wheel or brakes and should always be prepared to do so, and manually operate the windshield wiper settings at all times,” the statement said.

While Tesla advises its drivers to keep alert behind the wheel, recent incidents have demonstrated that’s not always the case. California police arrested a Tesla driver last year for allegedly falling asleep while driving intoxicated. In another case, the National Transportation Safety Board determined “the lack of sufficient system controls” in a Tesla Model S were partially to blame for an accident that resulted in the death of a driver.

Last month, two researchers were awarded $35,000 for proving they could hack a Tesla’s onboard internet browser, as CyberScoop reported.

Keen Security Lab is known for its research into connected vehicles. Practitioners have uncovered flaws in BMW cars, as well as vulnerabilities in products made by tech companies including Microsoft and VMWare.

Keen is a part of Tencent Holdings, a multinational Chinese conglomerate with subsidiaries in areas including entertainment, technology and video games. Tencent also is building its own autonomous driving team, according to job listings posted late last year on LinkedIn, Reuters reported.

A video demonstrating the just-published research is available below.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure