Bluetooth Attack Can Steal a Tesla Model X in Minutes
wired.com
wired.com
What matters to me is that Tesla is responsive, unlike many other companies that we know of.
Many people refer to it as "relay theft" since historically it's often just a matter of relaying/repeating a signal - there may be no real authentication involved.
Around physical security, I'm often reminded that "locks are for honest thieves".
Anyone can break a window to steal your stuff, getting a duplicate immobilizer chip is hard and usually requires an inside man in a dealer network.
Unless you talk to the car's ECUs over the diagnostic port and read out the secret values for creating a duplicate or outright patch out the immobilizer check in the firmware. There's usually no auth on this and it's just obscurity, which I expect to already be broken and exploited by tools available on the black market.
I can't imagine any car would stop if it lost signal with immobilizer chip- that would be a safety problem. That is how relay attacks work- signal is required only for a brief period.
So it's wireless... So someone can still use a relay attack to send the signal from the start button to the keys hanging up by your front door...
The only exception is if I have full control over it, including the ability to lock it down. No OTA updates; if I want to install security patches, it'll be through Ethernet or USB or some other wired connection. But preferably, there wouldn't be a whole lot of software to update in the first place.
That seems to me to be far more secure than a modern tesla.
There's far less chance of leaving your key in the car if you have to press the lock button on the fob after you get out -- done that on hire cars before. The key is always in the same place.
Conversely you can leave the key in the ignition if you're popping into the store to pay for the gas and leaving your passengers in the car. I had a keyless fob on another hire car in my pocket, alarm went off when I went into the store.
I don't get the appeal of keyless.
And modern cars absolutely know how to switch safely to a "limp mode" that lets you pull over safely.
Many manufacturers have actually worked to improve wireless key security. Including Tesla. But this is a new class of attack on the key fob.
I had a colleague of mine whose BMW was broken into at night. He woke up to police in front of his house (called by BMW's own alert system), there's an atmospheric pressure sensor inside the car and everything.
No sign of the thieves, so he booked an appointment to have the window fixed and didn't think much of it. But then he realized the side panel (in the door column? the column between the front and rear doors) was tweaked over a bit.
The thieves had gone in and cut the cable tree going to the roof of the car, which contains amongst other things the antenna and connection to BMW's alert service. Their plan was to come in the one night, disappear, hope the victim didn't notice that (and the garage doesn't check for it), and come in to steal it for real the next day, or maybe even the same night after the police has gone again.
For Tesla, if they really want they could pry open the frunk and remove the 12V power from the low-voltage battery, then winch the car onto a flatbed. That would disable the GPS tracking and allow access to make money parting out the car. Although not the motors, which are locked to the VCSEC and the owner's configured keys, and bypassing that is still an open problem AFAIK.
Keyless ignition is popular enough with consumers it's likely here to stay.
The last one I heard about was keyless entry systems being abused; thieves carry a briefcase-sized antenna around, amplifying and directing the signal from the car asking the key fob to unlock.
Of course, ideally they want to break into your house and grab the key.
I believe most stolen cars are sent to a "chop shop". There are plenty of useful parts that can be sold. You don't need to start it or worry about someone tracing the vin if you just take untraceable parts off the car.
This is the stance I take when I’m looking at replacing my door locks. I read reviews that talk about the super secure Schlege lock being picked easily and feel like there’s no recourse, until I remember a criminal is more likely to simply put a brick through a window to get in than pick the lock.
When did I say that?
I don't get this sort of argument because its just a new vector for a new form of convenience. Ideally there are multiple failsafes to prevent theft even in a keyless vehicle.
I guess the best you could do would be to use a GPS scrambler of some sort and force the car to report its location in the middle of the Atlantic or something.
"The bank robbers are on 4th street. Now, they are turning westbound onto Main st. etc."
It's really not that complicated (they mention it already had a cert but it just wasn't being used) and adds so much security value.
Can't do most of those with an electric car.
As a nascent technology for cars as is this one, it is expected to have some flaws. I imagine that when locks were designed they were not the securest thing in world to protect your stuff.
Of course we can do better in terms of security, there is always room to improve. It looks like there is a great flaw here that could get a fix, but I would not dismiss this technology just because of this.
Where there is a lock there will always be a key.
Also, as GP mentioned, a physical switch that disables Bluetooth on the key fob when the owner isn't actively using it would make this attack much harder.
If there is no threat of force, just wait the attacker out.
If there is a threat of force (for example, the attacker has a gun), then you would have been just as bad off without some crazy movie-plot attack involving your door locks.
I think we have to ultimately put our faith into the fact that other people do not want to get us killed.
That’s how the roads operate in general. Someone could easily swerve into your lane and cause a head on collision at any time. Or in the case that they only have a desire to harm others there are nearly limitless possibilities to what someone could do to the shared roads. Most of the time I’m shocked that driving is as safe as it is really.
Maybe they were, we don't actually know.
1. If someone synced a new keyfob or phone to their Tesla, it would show up on the owner's phone as a new car key added + it would also show up in the car menu.
2. They could've taken it for joyrides, but there is no way the owner wouldn't notice. The current car position is always updated in the app, the range it was driven is updated in the car, and the charge consumption is easy to display. It would be weird to see that the car is driving miles and miles without me operating it. And that's not even mentioning all the other "normal" things that would be noticeable, like charge levels being off, car positioning, etc.
(x) useless as a car. It can be only used for spare parts and whatever is left unattended inside the car.
Maybe the seats would be worth something or the wheels, but it doesn't seem to be worth it really. Besides, Tesla's are still pretty high end and most purchasers are not really looking for a $50 set of wheels.
"Ahh we can't service your car/accept it as a trade-in since it contains parts that were reported stolen".
Or do we already live in a world where cars don't work without internet access?
I don't think there's any Tesla feature that is deliberately gimped due to lack of Internet access.
On serious side, Tesla definitely could implement a security check if it's rebooted and there is no network connection on startup. Obviously not when already driving.
Is this worse than the guy in the parking lot with a crowbar breaking windows instead?
Except this break in had nothing to do with the internet. So why are you complaining in this thread?
I thought they made it pretty clear.
https://www.companynewshq.com/company-news/personal-finance-...
Not every thief has the same motivations. This guy in PA kept his stolen Ferraris in his garage for years with the very rare weekend drive.
http://wheelerdealers.discoveryuk.com/gallery/lamborghini-ur...
https://en.wikipedia.org/wiki/Lamborghini_Urraco
I wonder how a party apparatchik obtained this one during the Cold War.
There’s a lot of people trying to repair/rebuild their cars. And Tesla makes it hard/impossible to get parts from them, which most likely increases demand for used parts.
You can check stories from Rich Rebuilds about how hard Tesla makes it for people to work on those cars.
I suspect you are right about the value of Tesla parts though.
As for the battery, that also is traceable and necessarily so if the new operator wishes to use a Supercharger. A Tesla that can't supercharge is much less valuable than a Tesla that can, so that would be pretty hard to hide from the end user. A stolen battery ends up being a con job on the end buyer.
With Teslas, the exterior parts (like the panels) are the most valuable, because those are the parts in shortest supply for the kind of work that third-party repair shops can handle. If you have an issue with the battery, that's not something a third-party shop can handle.
Anyone wanting to steal a car can just roll up with a tow truck, so car companies don’t put a lot of effort into this stuff. Hell, I have done the got into someone else’s car sit down and realize it’s not my car. As in I unintentionally unliked the wrong car. I know of 2 other people who had similar experiences with different brands.
My car keys are right inside the front door, so stand on my porch and you're well within range.
> and know the VIN
Good thing the VIN is required by law to be visible through the front windshield of your car, which is very likely parked in your driveway, on your way to the front door.
When I was an auto mechanic back in the 90s, more than once I've pulled a car into a bay that wasn't the car I was supposed to work on. The keys matched, make and model matched, must be the one that needs an oil change. And, yes, I've changed the oil on a car that wasn't there for an oil change.
It didn't happen but a handful of times over a few years, but it did occasionally happen. Does it happen with modern keyless entry? Dunno, I've been a software dev for the last 25 years.
And the lack of a cert sent to the fob verifying the key is from Tesla.... this is all so inexcusable.
- Has cameras to record and store everything going on outside and inside it (Sentry Mode)
- Location tracking, where in the app you can literally see where your car is on a map
- Remote control from the app over certain car features
If someone does try to steal one, they’re taking a bigger risk of being caught compared to other cars.
https://www.imec-int.com/en/press/belgian-security-researche...