A loop hole in the security system of the popular Mitsubishi Outlander PHEV means thieves who exploit the bug can break into and steal the vehicle.
The breach can also be used to tamper with some of the car’s settings and drain the battery.
Mitsubishi is recommending that owners should turn off the wi-fi while it investigates the problem.
Security researchers at Pen Test Partners began investigating the car after one of its consultants noticed that the mobile app had an unusual method of connecting to the vehicle.
While most remote control apps for work using a web service hosted by either the car’s manufacturer or its service provider through the GSM mobile network to a module on the car, the Outlander PHEV does it differently.
Security flaw
Owners need to disconnect from any other Wi-Fi networks and explicitly connect to the car ‘access point’ in order to control car functions.
The Wi-Fi pre-shared key is written is included in the owner’s manual but researchers say the format is too simple and too short, allowing hackers to crack the keys within four days.
In a statement, Mitsubishi said: “This hacking is a first for us as no other has been reported anywhere else in the world.”
It said it “took the matter seriously” and was keen for the researcher to talk to its engineers in Japan to understand what he found and how it could be remedied.
It added: “It should be noted that without the remote control device, the car cannot be started and driven away.”