Want another reason to be skeptical about the idea of connected cars? Here's one: when Nissan put together the companion app for its Leaf electric vehicle—the app will turn the climate control on or off—it decided not to bother requiring any kind of authentication. When a Leaf owner connects to their car via a smartphone, the only information that Nissan's APIs use to target the car is its VIN—the requests are all anonymous. Those are the findings of Troy Hunt and Scott Helme, who published their findings on Wednesday. Thursday, Nissan took the service offline.

Hunt started poking into NissanConnect after running a workshop in Norway in January. Norway is overflowing with EVs, and one of them belonged to an attendee. "What the workshop attendee ultimately discovered was that not only could he connect to his LEAF over the internet and control features independently of how Nissan had designed the app, he could control other people’s LEAFs." Upon discovering that his friend Helme also owned a Leaf, the pair began to investigate just how insecure NissanConnect was.

In a lengthy post describing the details of the security flaw, Hunt also lays out a timeline as well as the ethical justification for doing so. He first contacted Nissan to alert it to the problem on January 23rd, describing the company as "receptive" and their behavior as "exemplary" during the process. But it didn't move with sufficient speed for Hunt, as he received an e-mail from a Canadian Leaf owner last week about the issue. He let Nissan know he was planning on going public, doing so on Wednesday.

That appears to have had the desired effect, with NissanConnect going offline worldwide today. In a statement given to Helme, the company said the service was unavailable following "information from an independent IT consultant and subsequent Nissan investigation that found the dedicated server for the app had an issue that enabled the temperature control and other telematics functions to be accessible via a nonsecure route."

The consequences of maliciously exploiting Nissan's lackadaisical attitude towards security in this case would have been relatively minor; the system couldn't remotely start or stop a vehicle, nor lock or unlock it. But that doesn't excuse a fundamental disregard for its customers' safety and privacy.