Nissan has disabled the smartphone app used by its popular Leaf electric car, following the publication of a major security flaw that could have allowed hackers to easily drain the car's battery.
The company told Tech Insider that the app — called NissanConnectEV (formerly CarWings) — is currently unavailable. This comes following research from an independent IT consultant and an internal investigation that found the app allowed anyone to see some navigation data and control temperatures inside the car.
That independent IT consultant was Troy Hunt, an Australia-based security researcher who found the flaw more than a month ago. In a post on his blog, Hunt claims that he reached out to Nissan then, so that the company could address the security flaw. He made multiple attempts to get a resolution, but ultimately decided to make the flaw public on Wednesday after others discovered the problem and began discussing it online.
Fortunately, the Leaf doesn't have features like remote unlock of its doors. But the flaw allowed a hacker to easily run API commands to turn on a car's heated seats or A/C from the other side of the world that could have left a victim stranded.
"If I was to monitor your movements over the course of the week and learn when you go to and from work, shortly after you got to your office I could run the heating for the remainder of the day," Scott Helme, a cybersecurity researcher who worked with Hunt, told the BBC. "That would potentially leave you with very little power. Certainly not enough to get back home."
Though Leaf drivers can't use their mobile app for now, all the functions available on the phone can still be controlled manually. Nissan said it was looking forward to launching updated versions of its app "very soon."
"No other critical driving elements of the Nissan Leaf are affected, and our 200,000 Leaf drivers across the world can continue to use their cars safely and with total confidence," the company said.
