The Nissan leaf & It’s App

One of the pros of having an electric vehicle is that its massive batteries allow it to do stuff for you even while the engine is off. Like, you can turn on the heat or the air conditioning in advance to make the car habitable before you need to use it. Unfortunately, if you’ve owned a Nissan Leaf for more than a week, anyone else could potentially have turned your heat or A/C on and off as well, thanks to a gaping security hole that turned a VIN number into an all-access pass to a vehicle’s climate control and historical trip info.Security researchers Troy Hunt and  Scott Helme, acting on a tip from an online forum, confirmed that when a Leaf interfaces with the NissanConnect app through one of Nissan’s servers, information is provided about the state of any vehicle that you have a VIN number for. Essentially, the API allows you to ask, “what is the status of the battery of the Nissan Leaf with VIN number X,” and it’ll return an answer, without any verification, they wrote in a blog post. You can get battery and charging information, climate control status, and even details about past trips that the car has taken.  While the climate control is programmed to turn itself off after 15 minutes when the car is unplugged, there’s nothing stopping the API from sending multiple commands over and over. You could park your car somewhere, and come back several hours later to a blasting A/C and a nearly dead battery. The company disabled the NissanConnect app soonafter.