LEAF Carwings NissanConnect EV remote control app grounded

2013NissanLeafLEAF owners with NissanConnect EV Carwings apps will have to wait for a new app and update for remote functions like turning on the climate control. The app has been suspended after an easy hack was revealed by security expert Troy Hunt.

According to Nissan:

Thec NissanConnect EV app (formerly called CarWings and is used for the Nissan LEAF) is currently unavailable. This follows information from an independent IT consultant and subsequent internal Nissan investigation that found the dedicated server for the app had an issue that enabled the temperature control and other telematics functions to be accessible via a non-secure route.

 No other critical driving elements of the Nissan LEAF are affected, and our 200,000 LEAF drivers across the world can continue to use their cars safely and with total confidence. The only functions that are affected are those controlled via the mobile phone – all of which are still available to be used manually, as with any standard vehicle. We apologize for the disappointment caused to our Nissan LEAF customers who have enjoyed the benefits of our mobile apps. However, the quality and seamless operation of our products is paramount. 

 We’re looking forward to launching updated versions of our apps very soon.

Security expert Troy Hunt showed on a YouTube video and on his website how he could turn on the heat in a LEAF in England from Australia.

The team was able to access to turn on heated seats, activate climate control and make VIN numbers until they found another owner’s LEAF VIN number.

Earlier today Nissan issued this statement

Nissan is aware of a data issue relating to the NissanConnect EV app that impacts the climate control and state of charge functions. It has no effect whatsoever on the vehicle’s operation or safety.

Our global technology and product teams are currently working on a permanent and robust solution. We are committed to resolving the issue as a matter of priority, ensuring that we deliver the best possible experience for our customers through the app now and in the future.”

“The API can be accessed anonymously. It’s a GET request so there was nothing passed in the body nor was there anything like a bearer token in the request header. In fact, the only thing identifying his vehicle was the VIN,” wrote Hunt on his blog.

CarWingsI looked at my Nissan LEAF through the web portal at 4:45pm PST and it was still working. The connection was slow but is still showing the battery charge.

At 6:45pm PST,  I started the climate control from the web portal when I walked to the alley where my car was parked the blue lights on the dash under the windshield were flashing and the climate control fan was blowing.
At 9:55pm PST, I was able to login into the Nissan Connect website and check that my battery is charging.
I can still access all my energy usage stats and daily mileage records through the Nissan Connect web portal.
I can not login to the CARWINGS app I get “Failed to log in to the Nissan owner section. Please try logging in later.”
The demise of the app is not a serious problem for me in Los Angeles, I don’t need to turn on the heat because it cold. It’s not hot enough to turn on the air conditioner, immediately. I can always walk outside to the garage to see if the LEAF is charged.
I can also check via the web portal if needed.

Older model Nissan LEAFs use 2G cellular connections which will be phased out at the end of 2016. The good thing about the Carwings apps is that we don’t pay anything for it. Hyundai Blue Link costs $99 a year and GM OnStar Remote Link is only free for 5 years.

Update 2/25/2016 We have confirmed from Nissan spokesman Steve Yaeger that “the web portal is still operational and is safe to use. The mobile app server only is off line.”

What about my fellow LEAF owners/drivers what do you think about the hack and the loss of Carwings? Let us know your thoughts in the comments below.
 webportal treesaved

2 thoughts on “LEAF Carwings NissanConnect EV remote control app grounded”

  1. My web portal does not work. I just paid $199 to upgrade my TCU from 2g to whatever the new unit is, then Nissan shuts it off. The car now can not connect to anything. Please explain how this is not fraud? Charging customers for parts that will not work.

    • I would call national Nissan Customer Support and make a complaint. You can also dispute the charge on your credit card. You can also call another dealer. It should have a warranty and work for you.

      Thank you for your input.

Comments are closed.