Security Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla
summary
Black-box testing of 2025 Tesla Model 3 and Cybertruck inside a Faraday tent uses a Marison box, USRPs, Tesla toolbox and Consumer Reports vehicles to demonstrate IMSI catching, rogue base station hijacking with a 90–100% success rate after 2–4.5 seconds of engagement, and data-plane denial of service where the TCU keeps HTTPS sessions open but cannot reach back-end services. Tests show acceptance of arbitrary PLMNs, dual-stage allowlists that are bypassable, an open interactive SMS service with no user-visible notification, legacy 2G ciphers, and broken fallback/recovery logic.
AI-written summary · about
chapters (17)
- 0:00Connected car LTE security
- 1:51New cellular testing in vehicles
- 3:59Car vs smartphone cellular risks
- 5:02Tesla vehicle selection
- 6:24Vehicle integration testing
- 7:27Threat model in vehicle research
- 8:10IMSI catching findings
- 9:14False base station attacks
- 10:15DoS impact on data plane
- 11:19Fault injection failures
- 12:22Undocumented SMS service
- 13:29PLMN whitelist bypass
- 14:34Emergency broadcast spoofing
- 15:40GSM 2G downgrade risks
- 16:24Vulnerabilities to UN 155/156
- 17:06Countermeasures and compliance
- 17:47Takeaways and future directions
related talks
44mLTE And IMSI Catchers: Then And Now
40mSecuring the Connected Car
40mUnlocking the Drive: Exploiting Tesla Model 3
43mSecuring the Connected Car
01h 06mLTE & IMSI Catcher Myths
37mAutomatic Automotive Hacking
15mThreat Analysis and Detection in In-Vehicle Infotainment System Leveraging MITRE...
54mExposing device features on 4G & 5G networks