Less than two weeks after the news broke that there was a massive security hole in its online NissanConnect telematics service, Nissan North America took its entire Nissan Owners web portal offline for several hours today, citing security concerns.
Usually accessible via Nissan’s official U.S. website, the Nissan owners portal allows owners of both Nissan and Infiniti vehicles the capability to remotely interact with various vehicle features with a regular computer or smartphone. It serves as a one-stop-shop where customers can find out additional information about their car, learn how to use specific vehicle features, find a local dealership, and check on things like service schedules. For owners of the Nissan LEAF electric car, the same site allows owners of the Nissan LEAF SV and SL to remotely begin charging their vehicle, check on its state of charge, program a new destination in the satellite navigation system, and activate cabin preconditioning.
But as eagle-eyed reader and Nissan LEAF owner Mark Larsen noticed this morning, Nissan’s usual owner web portal was replaced with a simple message in white text on a black background. It read: “Sorry for the inconvenience, but our site is currently unavailable. We appreciate your patience as we work through this technical difficulty.”
While the site has since come back online, the reason for the switch off appears to be related to a security issue with the site itself.
“The Nissan IT Security team has elected to take the North American Nissan and Infiniti Owner Portals temporarily offline for preventative maintenance. We plan to bring the U.S. and Canadian Nissan and Infiniti Owner Portals servers back online soon, and we regret any inconveninece this may cause our North American Nissan and Infiniti owners,” a spokesperson for the the Japanese automaker told us earlier today in an official emailed statement.
While the Nissan LEAF itself has enjoyed reasonably good customer satisfaction since it launched back in late 2010, its telematics system has earned itself a poor reputation. From intermittent connectivity issues through to unreliable smartphone apps, Nissan made the decision last year to rebrand its original CARWINGS telematics system as NissanConnect EV, giving the system a refreshed app, new API and more features for owners of newer cars.
But despite the rebrand and the new hardware, Nissan’s electric car telematics has remained unreliable. Earlier this year, Nissan Europe halted all sales of the 2016 Nissan LEAF due to a hardware fault with the new telematics system. Then two weeks ago, a far more serious flaw was discovered.
Unlike the old system, which required a username and password to be passed to the servers before access was granted, researchers demonstrated that the new NissanConnect EV allowed commands to be sent to any Nissan LEAF registered with the service by simply knowing the car’s VIN — a string that is both easily guessable and displayed at the bottom of every vehicle windshield.
In response to the publication of the exploit, Nissan promptly switched off all access to its systems from outside the NissanUSA domain, cutting off both third-party apps and its own smartphone apps. For the past two weeks, anyone seeking to connect to their car has been forced to go through Nissan’s official owner’s portal website — the very same one it took offline earlier today.
Upon logging back into the service this afternoon, Nissan LEAF owners will be greeted by the following message, acknowledging the lack of connectivity via the NissanConnect EV app.
“The NissanConnect Ev app is currently unavailable. We apologize for any disappointment caused to our Nissan LEAF customers who have enjoyed the benefits of our mobile app. In the meantime, Nissan LEAF owners can still access features via the Nissan Owner Portal. We are looking forward to launching updated versions of our app soon.”
Sadly, there’s no news as to when that will happen, but at least Nissan LEAF customers — at least those with Nissan LEAF SV and SL trim levels — can now use Nissan’s online web portal to remotely connect with their car.
As always, when that situation changes, we’ll be sure to let you know.
You can also support us directly as a monthly supporting member by visiting Patreon.com.