Mitsubishi Outlander PHEV at risk of hacking

Security experts showed how hackers and thieves can exploit a weakness in the Mitsubishi Outlander PHEV's Wi-Fi system to disarm the alarm

Mitsubishi Outlander PHEV - front

The Mitsubishi Outlander PHEV - UK's best selling plug-in electric car - has become the latest car susceptible to hacking, after weaknesses in the car's on-board Wi-Fi security allowed researchers to turn off security alarms.

Security expert Ken Munro and his colleagues at Pent Test Partners security firm began investigating the Outlander PHEV after Munro noticed the mobile app used to communicate with the car had an unusual characteristic.

Most mobile apps use a GSN module to communicate between the car and the mobile phone, but the Outlander PHEV does without one. Instead, the Mitsubishi has a wireless access point on-board the car, which means it can be talked to directly.

Munro then realised the password to the Wi-Fi key can be easily cracked. He said: “The password is not long enough. The format is four lower cases, plus six numeric digits. That just isn’t enough.” On a relatively slow cracking rig, it took Munro and his team just four days to crack the password key. With top notch software the key can be accessed within a day. 

Munro then looked if there was any more security between phone and the Wi-Fi access point other than the key. He said: “ We listened to look at the traffic going between the car and the device, and discovered a relatively simple binary protocol that was incredibly straightforward to understand and reverse engineer.”

This allowed Munro to communicate with the car directly, and gave him control of functions like lights and air-conditioning, and more worryingly, access to the charging and security status. Munro was able to turn off the car’s alarm and disconnect it from charging, showing how potential perps could break into the car and drive away with it. 

A short-term fix exists, according to Munro. He advises to first unpair all mobile devices that have been connected with the car's access point. Then, using the app, he advises users to go to 'Settings' and select 'Cancel VIN registration', to effectively put the device to sleep. A long-term fix would require intervention from Mitsubishi. 

Mitsubishi has since said it has taken the “matter seriously". It also pointed out that the hack affects the car's app and gives hackers limited access: “It should be noted that without the remote control device, the car cannot be started and driven away." 

Are you worried about car hackers? Tell us in the comments below...

Recommended

Four million people in the UK have fallen asleep while driving
Tired driver
News

Four million people in the UK have fallen asleep while driving

Research produces worrying revelation that four million UK motorists have nodded off behind the wheel at some point
16 Jun 2021
Thatcham approved devices and crash tests explained
Joe Finnerty in Hyper G sled
Consumer news

Thatcham approved devices and crash tests explained

Thatcham studies crashes, rates alarms and sets insurance groups to help cut drivers’ costs. We find out how
11 May 2021
Company car tax guide 2021/2022: everything you need to know
Executive saloons make popular company cars
Consumer news

Company car tax guide 2021/2022: everything you need to know

Company car tax is bound up in a complex net of emissions, salaries and a car's value; we explain how the system looks for the 2021/22 Financial Year
27 Apr 2021
No new smart motorways to open without stopped vehicle detection
smart motorway
News

No new smart motorways to open without stopped vehicle detection

Implementation of SVD technology to be accelerated, with existing smart motorways getting the system six months earlier than planned
21 Apr 2021

Most Popular

Driving test update to preserve the manual gearbox
Dacia Duster gear lever
News

Driving test update to preserve the manual gearbox

With more drivers learning in autos and electric cars, the DVSA is looking to update the driving test so people can still drive manuals in future
16 Jun 2021
Ineos Grenadier prototype 2022 review
Ineos Grenadier prototype
Ineos Grenadier 4x4

Ineos Grenadier prototype 2022 review

Can the Ineos Grenadier really fill the mud-splattered void left by the old Land Rover Defender? We take a first drive in a prototype to find out...
15 Jun 2021
New 2021 Vauxhall Astra to offer plug-in hybrid power
Vauxhall Astra render
Vauxhall Astra

New 2021 Vauxhall Astra to offer plug-in hybrid power

The new Vauxhall Astra will get a plug-in hybrid powertrain and a more premium image - here’s how it could look
17 Jun 2021
Tesla Model 3 police car all set for evaluation by UK emergency services
Tesla Model 3 police car - front
News

Tesla Model 3 police car all set for evaluation by UK emergency services

Tesla hopes to offer UK police forces a new zero-emission emergency responder option with the Model 3 police car
17 Jun 2021
Illegal car modification hotspots revealed
Volkswagen Polo exhaust
News

Illegal car modification hotspots revealed

Gloucestershire has the highest proportion of illegal car modifications, with altered number plates the most common breach
14 Jun 2021
New Renault Arkana 2021 review
Renault Arkana - front
Renault Arkana

New Renault Arkana 2021 review

Does an eye-catching coupe-SUV body give the new Renault Arkana the edge over other mid-size SUVs? We find out...
16 Jun 2021
New Vauxhall Astra prototype review
Vauxhall Astra prototype - front
Vauxhall Astra

New Vauxhall Astra prototype review

A new Vauxhall Astra is on the way and we've driven a prototype ahead of its official arrival
14 Jun 2021
UN report highlights ethical problems with electric cars
Electric car charging
News

UN report highlights ethical problems with electric cars

Analysis reveals lithium refining takes 65 per cent of Chilean region’s water, while 40,000 child miners dig for cobalt in DRC
14 Jun 2021
New Nissan Qashqai 2021 review
Nissan Qashqai 2021
Nissan Qashqai

New Nissan Qashqai 2021 review

We get behind the wheel of the larger, more comfortable and higher-tech Nissan Qashqai SUV in the UK
16 Jun 2021
New Porsche 911 GT3 Touring tones down the styling
Porsche 911 GT3 Touring - front
Porsche 911

New Porsche 911 GT3 Touring tones down the styling

The optional Touring package aims to bring a few creature comforts to the track-focused Porsche 911 GT3
15 Jun 2021
Dacia unveils new badge design
Dacia badge
Dacia

Dacia unveils new badge design

The new Dacia branding will feature on the company’s cars from 2022, with the Bigster being the first candidate
17 Jun 2021
'I was cynical about Hyundai's aim to be the world's 2nd biggest carmaker, not now'
Opinion Genesis Hyundai Ioniq
Opinion

'I was cynical about Hyundai's aim to be the world's 2nd biggest carmaker, not now'

Steve Fowler is impressed by Hyundai's electric cars, its N division and now its luxury Genesis brand
16 Jun 2021
New SsangYong Korando e-Motion breaks cover with electric power
SsangYong Korando EV
Electric cars

New SsangYong Korando e-Motion breaks cover with electric power

The new SsangYong Korando compact electric SUV will be on sale later in 2021, says the financially stricken South Korean manufacturer
15 Jun 2021
Motorists think they can get away with driving offences due to lack of road police
police speed gun
News

Motorists think they can get away with driving offences due to lack of road police

Lack of road traffic police officers in the UK is making it easy for drivers to break the law, according to a survey of 15,500 British motorists
16 Jun 2021