Keen Security Lab

Keen Security Lab is a vulnerability research team operated by Tencent, the Chinese technology conglomerate. Originally known as Keen Team before its acquisition by Tencent, the lab built a reputation in browser and mobile exploitation before becoming one of the most prolific publishers of automotive and connected-vehicle security research in the world.

Tesla Research

Keen Security Lab's first major automotive disclosure came on September 19, 2016, when it published research demonstrating remote control of a Tesla Model S — both parked and while driving — without physical access to the vehicle, by compromising the car's CAN bus through a chain of vulnerabilities. The findings were reported to Tesla's product security team, which confirmed and patched the issues; Tesla publicly credited the lab.

The lab returned to Tesla research repeatedly. On March 29, 2019, it published "Experimental Security Research of Tesla Autopilot," showing that adversarial physical-world stickers could trick Tesla's computer-vision-based lane recognition into steering a vehicle into the reverse lane, that similarly crafted visual patterns could falsely trigger the automatic wipers, and that after compromising a Model S (firmware 2018.6.1) the team could take over the electric power steering via a wireless gamepad even with Autopilot disengaged. Tesla responded that the wiper scenario involved a beta feature and that the steering-related issues had already been addressed in prior security updates.

On January 2, 2020, Keen Security Lab disclosed "Exploiting Wi-Fi Stack on Tesla Model S," detailing two vulnerabilities in the vehicle's Parrot Wi-Fi module (Marvell 88W8688 chipset): a heap overflow in the firmware's 802.11e WMM (ADDTS) frame handling, and a stack buffer overflow in the Linux Marvell Wi-Fi driver's HostCmd_CMD_GET_MEM response handling, together enabling remote code execution over Wi-Fi with roughly a 10% success rate in testing. The issues were reported to Tesla in March 2019, assigned CVE-2019-13581 and CVE-2019-13582, patched in firmware 2019.36.2+, and disclosed publicly in January 2020.

BMW Research

On May 22, 2018, the lab published "Experimental Security Assessment of BMW Cars," the result of research begun in January 2017. It documented 14 vulnerabilities, 7 of which received CVE identifiers, spanning BMW head units (i, X, 3, 5, and 7 Series), Telematics Control Units (models from 2012 onward), and Central Gateway Modules. Attack surfaces included the BMW ConnectedDrive system, GSM connectivity, remote diagnosis functions, Bluetooth, USB, and OBD-II. The findings were reported to BMW on February 25, 2018, confirmed by BMW on March 9, 2018, and CVEs were reserved by April 5, 2018; BMW began deploying remote and dealer-network software fixes starting in mid-April 2018.

Other Automotive and Non-Automotive Work

Keen Security Lab also published assessments of Lexus AVN infotainment systems (March 30, 2020) and Mercedes-Benz's MBUX infotainment platform (May 12, 2021). Outside the automotive space, the lab is known for earlier work on browser and virtualization security, including VMware guest-to-host escape research (April 2018) and iOS Multipath TCP exploitation (July 2018), and it hosted the TenSec international security conference in 2018 and 2019.

Note: some secondary details (exact vulnerability counts, model-year scope, and success-rate figures) are drawn from the lab's own published summaries; the Lexus and Mercedes-Benz reports are sourced only from the lab's own site listing and have not been independently cross-checked against outside press coverage in this research pass.

Timeline

• 2016-09-19Keen Security Lab publishes research demonstrating remote control of a Tesla Model S (parked and while driving) via a CAN bus compromise; Tesla confirms and patches the vulnerabilities.
• 2017-01Research into BMW connected vehicle systems begins.
• 2018-02-25BMW vulnerability findings reported to BMW.
• 2018-03-09BMW confirms all reported findings.
• 2018-04-05CVE numbers reserved for BMW vulnerabilities.
• 2018-04Keen Security Lab publishes VMware guest-to-host escape research.
• 2018-05-22"Experimental Security Assessment of BMW Cars" publicly released, detailing 14 vulnerabilities (7 with CVEs) across BMW head units, TCUs, and gateway modules.
• 2018-07Publication of iOS Multipath TCP exploitation research.
• 2019-03Tesla Model S Wi-Fi module vulnerabilities reported to Tesla.
• 2019-03-29"Experimental Security Research of Tesla Autopilot" published, covering adversarial lane-recognition and auto-wiper attacks and gamepad-based steering takeover.
• 2019-11CVE-2019-13581 and CVE-2019-13582 assigned for Tesla Wi-Fi module vulnerabilities.
• 2020-01-02"Exploiting Wi-Fi Stack on Tesla Model S" published, detailing remote code execution via the Parrot Wi-Fi module.
• 2020-03-30"Experimental Security Assessment on Lexus Cars" published.
• 2021-05-12"Experimental Security Assessment of Mercedes-Benz Cars" published, covering the MBUX infotainment system.