Is Your Car a BYOD Risk? Researchers Demonstrate How

Is Your Car a BYOD Risk? researchers have demonstrated that a car can serve as an initial access vector into a corporate network, with a PoC attack chain unfolding from a parked vehicle to company Linux servers and ESXi hypervisors. At BSides NYC on Oct 18, Threatlight’s CTO Tim Shipp described how a fleet of company‑issued Teslas and the drivers’ phones connected to them formed the core of the attack path, effectively creating a BYOC—bring-your-own-car—attack.

The demonstration used affordable gear, including cardputers, NRF24 transceivers, and a FlipperZero hacking multitool to jam Bluetooth signals and spoof a Tesla device name, allowing the tester to lure a driver into connecting. From there, an Android APK established a Metasploit shell back to a C2 infrastructure, enabling lateral movement toward domain controllers and ESXi hypervisors.

The researchers argued that gaps between security tools and a holistic approach to mobile and network security are what enable such chain exploits, rather than reliance on a single vulnerability. according to Threatlight.