Nissan LEAF / NissanConnect EV severe security vulnerability

My Nissan Leaf Forum

Help Support My Nissan Leaf Forum:

This site may earn a commission from merchant affiliate links, including eBay, Amazon, and others.
jayl said:
Stanton said:
jayl said:
just wanted to subscribe to this thread..

does anyone know if the car itself has a public IP? I understand from reading somewhere it has a phone number..

The answers are: are you kidding (Nissan tracks by VIN)? and sort of (it has a SIM card), but it won't "answer" a call.


i wasnt asking for the public IP for authentication i knew they did this by VIN.

I wanted to know about the IP to understand how the communication happens between the car and the nissan cloud.

I hope nobody knows this or we're in more trouble than when someone figured out how the (mobile) API works. Basically Nissan has a server that sits between the car and us (the outside world cannot talk directly to the car).
 
i am sure someone knows...

i am guessing its some type of P2p encrypted (IP Link, or I hope ). probably a very limited data service with the same sim / provider thats used for texts, so there has to be an IP however it might be a private IP on the provider's network ..
 
Any ETA on when NissanConnect will start working again? I would like to enroll my new 2016 LEAF, but don't want to have the process crash or not be possible.

Can the new car even be added to my existing account?
 
reeler said:
Any ETA on when NissanConnect will start working again? I would like to enroll my new 2016 LEAF, but don't want to have the process crash or not be possible.

Can the new car even be added to my existing account?

You can add the new car to you account, I started to add mine got to the TOS and didn't proceed from there....don't like the idea of handing over info but I am sure I will give in eventually..
 
I finally gave in and wanted to see if I could connect to my car (I stopped using it late last year after app updates and loss of connections and my confusion over carwings, no, NissanConnect, no, yes, carwings still works, yes, no it doesn't etc etc).

I found my website login and did so, before I got anywhere i was presented with this message.



I was able to look at my car's status on the website though. I guessing this is the latest and greatest news and the apps do not work. Is this correct?

I don't want to try the app until I know it's working because, before it would sometimes work and I never knew if it was a problem with signal or the app or some other technical problem Nissan were not telling us about until someone threatened to sue them.
 
Apps are updated and working now in Canada, both iOS and Android.

Much more secure now, user's password is encrypted prior to sending and a session id is required after authentication. The way it should have always been really!
 
windsorsean said:
Apps are updated and working now in Canada, both iOS and Android.

Much more secure now, user's password is encrypted prior to sending and a session id is required after authentication. The way it should have always been really!

Any other updates to the app or is it purely a security update?
 
Valdemar said:
Just installed it on Android and you can't get past the login screen, the country selection is unavailable. duh.

US version is still from 2015.

https://play.google.com/store/apps/details?id=com.aqsmartphone.android.nissan&hl=en

Updated December 8, 2015

Current Version 4.0.1



Until that page changes you can just uninstall the app from your phone.
 
cwerdna said:
http://www.mynissanleaf.com/viewtopic.php?p=453927#p453927
http://www.mynissanleaf.com/viewtopic.php?p=453942#p453942

Also, yesterday or so, they finally put up the notice below at https://owners.nissanusa.com/nowners/ after you login
The NissanConnect EV app is currently unavailable. We apologize for any disappointment caused to our Nissan LEAF customers who have enjoyed the benefits of our mobile app. In the meantime, Nissan LEAF owners can still access features via the Nissan Owner Portal. We are looking forward to launching updated versions of our app very soon.
It's possible after more a month the App. Nissan EV still off !
A lover client Leaf from Siena Italy
 
I'm extremely disappointed in Nissan's communication on the telematics front. You have a security glitch, fine. But your solution is to turn it all off and not tell customers anything about what you're doing or when we can expect it back?
They took the same approach with the first gen owners communication on the Telematics Control Unit (2G). OK, so 2G is going away and we will have to get a replacement TCU by 12/16. Now what?
The TCU should be an official recall, not some kind of lame communication by paper mail saying maybe you will get a replacement. I still cannot find a dealer who knows what I'm talking about when I ask about a TCU replacement. When a company purposely makes a piece of equipment I am still paying off not functional, it is a recall. I keep looking for reasons to choose Nissan over Tesla or Chevy when I buy one of the new long-range EVs, but I keep failing.
Is anyone else having any luck on getting more information about the TCUs?

Best,
Josh
 
barsad22 said:
I'm extremely disappointed in Nissan's communication on the telematics front. You have a security glitch, fine. But your solution is to turn it all off and not tell customers anything about what you're doing or when we can expect it back?
They took the same approach with the first gen owners communication on the Telematics Control Unit (2G). OK, so 2G is going away and we will have to get a replacement TCU by 12/16. Now what?
The TCU should be an official recall, not some kind of lame communication by paper mail saying maybe you will get a replacement. I still cannot find a dealer who knows what I'm talking about when I ask about a TCU replacement. When a company purposely makes a piece of equipment I am still paying off not functional, it is a recall. I keep looking for reasons to choose Nissan over Tesla or Chevy when I buy one of the new long-range EVs, but I keep failing.
Is anyone else having any luck on getting more information about the TCUs?

Best,
Josh

I think you're over-reacting a bit: the term "recall" should be reserved for something that doesn't work as advertised and/or is a safety issue. Nissan has told us (almost since the car was new) that the TCU was dependent on 2G coverage that wouldn't last forever. In addition, Nissan has reached out to all owners (I received an email March 18) explaining that a modem upgrade will be available this year at a reasonable cost (we may differ on what's "reasonable", but since they haven't disclosed the amount, that's a discussion for later). I've said before that telematics is an important part of Nissan's strategy going forward, and I fully expect them to do what is necessary to maintain CarWings functionality for existing Leafs.
 
Stanton said:
the term "recall" should be reserved for something that doesn't work as advertised

Hold on a sec, let me log in to my NissanConnect app... oh, that's right, it doesn't work "as advertised" and hasn't for some time now. Using your own definition, this is a recall. Why make excuses for Nissan? I love the car just as much as anyone else in this Forum, but it doesn't mean we have to love the company or its communication strategy. Unlike you, I was never told that the car's Telematics Unit would someday not work, and I never received a March 18 e-mail, I received a piece of paper mail that made vague references to that "reasonable cost" replacement fee (does that mean $50 or $500? No way of knowing. It should be free.)
My guess is I am not the only one who never received this information from Nissan. No sales person would ever say something like that at a dealership, it wouldn't make sense to let customers know that a piece of the car would stop functioning in 5 years... so I'm not sure what other official source you heard that from.
The current downtime for the app is not something Nissan told us about ahead of time, it was a design flaw that left us all vulnerable for the last 5 years, and there should be some accountability for that. I do not share your confidence that Nissan will do right by its first gen owners, but I sincerely hope I will be proven wrong.

Best,
Josh
 
barsad22 said:
Stanton said:
the term "recall" should be reserved for something that doesn't work as advertised

Hold on a sec, let me log in to my NissanConnect app... oh, that's right, it doesn't work "as advertised" and hasn't for some time now. Using your own definition, this is a recall.
Recalls are generally for safety defects or non-compliance w/FMVSS. Carwings/NissanConnect no longer working due to AT&T's 2G shutdown doesn't come even close to that.


From https://vinrcl.safercar.gov/vin/faq.jsp
What's a Recall and When Is It Necessary?

A recall is issued when a manufacturer or NHTSA determines that a vehicle, equipment, car seat, or tire creates an unreasonable safety risk or fails to meet minimum safety standards. Manufacturers are required to fix the problem by repairing it, replacing it, offering a refund, or in rare cases repurchasing the vehicle.

The United States Code for Motor Vehicle Safety (Title 49, Chapter 301) defines motor vehicle safety as "the performance of a motor vehicle or motor vehicle equipment in a way that protects the public against unreasonable risk of accidents occurring because of the design, construction, or performance of a motor vehicle, and against unreasonable risk of death or injury in an accident, and includes nonoperational safety of a motor vehicle." A defect includes "any defect in performance, construction, a component, or material of a motor vehicle or motor vehicle equipment." Generally, a safety defect is defined as a problem that exists in a motor vehicle or item of motor vehicle equipment that:
poses a risk to motor vehicle safety, and
may exist in a group of vehicles of the same design or manufacture, or items of equipment of the same type and manufacture.
I will agree that the lack of direct communications to owners when NissanConnect smartphone apps were disabled was poor but the AT&T 2G shutdown affecting Carwings has been known for at least 2 years, if not longer. Google for stuff like these:
site:mynissanleaf.com carwings 2016
site:mynissanleaf.com carwings 2017


There was even speculation about this in 2012: http://www.mynissanleaf.com/viewtopic.php?t=9615.

It is unfortunate it took so long for Nissan to actually send out a notification as to the upgrade path. I did speak to someone from Nissan corporate (NOT a dealer rep) at a Drive Electric Week event in middle of 2015 telling him we've seen nothing from Nissan re: upgrade pathm if anym if AT&T shuts down their 2G network. I unfortunately never got around to dropping him an email reminding him to look into it. It's moot now.
 
cwerdna said:
Recalls are generally for safety defects or non-compliance w/FMVSS. Carwings/NissanConnect no longer working due to AT&T's 2G shutdown doesn't come even close to that.

I wasn't arguing legal terms, guys, of course recalls are a government-mandated safety order (and we have seen many car manufacturers in recent years like Toyota and GM try to avoid them even when inaction costs lives). Voluntary recalls can be done for any reason a car manufacturer wants (and the NHTSA does not have to order it), so that's the point I'm making. I just don't understand why Nissan, who surely wants my business for the 2.0 in a couple years rather than having me "Bolt" to Chevy or Tesla, would play it like this.

Still waiting to hear solid information, please post when you have it or hear from your friends at Nissan.

Best,
JG
 
Back
Top