EVANKING
Hacking a Tesla

Security research

Hacking a Tesla

Built the rig that remotely took control of a Tesla Model S for Consumer Watchdog's connected-car research — demonstrating that the exposure is fleet-wide, not per-vehicle.

Consumer Watchdog's connected-car research asked a question the industry preferred rhetorical: if a car's safety-critical systems share a network with its always-on internet connection, what can somebody outside the car do?

I built the rig that answered it. We took control of a Tesla Model S remotely — without anyone in the vehicle.

Why the demonstration mattered more than the report

The report existed. Reports about connected-car vulnerability had existed for years, and the industry response was consistently that the risk was theoretical, isolated, and being managed.

A working demonstration is not arguable in the same way. A box, a car, and the car doing something nobody in it asked for is a fact rather than a position, and it moves the conversation from whether to how many. That is the entire reason to build the hardware instead of publishing another paper.

The finding that actually matters

The headline is one car. The finding is the architecture.

Remote start reaches the vehicle through the same digital systems that carry steering, acceleration and braking. That is not a Tesla decision, it is an industry pattern — infotainment and telematics riding the same bus as the systems that stop the car. The consequence is that the exposure is not per-vehicle. Anything reachable through a manufacturer's always-connected fleet is reachable across that fleet.

That distinction is what took the work from a car story to a policy story, and it is why the recommendation was a physical disconnect between the internet-facing systems and the safety-critical ones, plus a kill switch the driver actually controls.

The part that is production, not engineering

None of this persuades anyone if nobody can see it. The demonstration was filmed and published, and the footage is what travelled — embedded in the Forbes coverage, run by outlets that were never going to read a technical appendix.

That is the shape of most of the work on this site. The research is only half of it; the other half is making the result legible to somebody who has ninety seconds and no engineering background. I did both ends of this one.