Slashdot Mirror
Tesla's Keyless Entry Vulnerable To Spoofing Attack, Researchers Find (theverge.com)
An anonymous reader quotes a report from The Verge: Researchers at KU Leuven have figured out a way to spoof Tesla's key fob system, as first reported by Wired. The result would let an attacker steal a Tesla simply by walking past the owner and cloning his key. The attack is particularly significant because Tesla pioneered the keyless entry concept, which has since spread to most luxury cars. This particular attack seems to have only worked on Model S units shipped before June, and in an update last week, Tesla pushed out an update that strengthened the encryption for the remaining vehicles. More importantly, the company added the option to require a PIN password before the car will start, effectively adding two-factor to your car. Tesla owners can add the PIN by disabling Passive Entry in the "Doors & Locks" section of "Settings."
The attack itself is fairly involved. Because of the back-and-forth protocol, attackers would first have to sniff out the car's Radio ID (broadcast from the car at all times), then relay that ID broadcast to a victim's key fob and listen for the response, typically from within three feet of the fob. If they can do that back-and-forth twice, the research team found they can work back to the secret key powering the fob's responses, letting them unlock the car and start the engine.
The attack itself is fairly involved. Because of the back-and-forth protocol, attackers would first have to sniff out the car's Radio ID (broadcast from the car at all times), then relay that ID broadcast to a victim's key fob and listen for the response, typically from within three feet of the fob. If they can do that back-and-forth twice, the research team found they can work back to the secret key powering the fob's responses, letting them unlock the car and start the engine.
Omigod, time to short TSLA! :)
...nothing to see here?
The first time I saw keyless entry it was on my 2005 Toyota Prius (still rolling, 108K miles thank you very much).
"The attack is particularly significant because Tesla pioneered the keyless entry concept, which has since spread to most luxury cars. "
What kind of propaganda bullshit is this?
Le'ts see what Wikipedia says:
https://en.wikipedia.org/wiki/...
Stop drinking the Flavoraid*.
*Historically accurate if you look it up.
"letting them unlock the car and start the engine"
Since when do EVs have "engines". I thought they had electric motors.
...then these people really, really, really screwed up. Like absolutely clueless about security. Unfortunately, that seems to be the standard with most EEs doing security these day.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Oh.
Wait.
It does.
-- Tigger warning: This post may contain tiggers! --
To be fair, with most systems you can be much farther away from the fob than 3 feet.
Unplug the battery when you leave it. Plug it back in when you are on MOOOOOVE!
No, they really didn't.
Keyless Entry / Go was introduced first by Mercedes-Benz in the S-Class car series in 1998. It was being pretty widely used in quite a few luxury brands before 2003 when Tesla was founded.
We regularly have a reminder that it is a bad idea to develop in house crypto. In this situation, it seems that reusing something like Mifare was the way to go.
Unless the 1993 Chevrolet Corvette was made by Tesla. The. No. Tesla did not pioneer keyless entry.
This one doesn't work for all cars. Most cars would require you to get the FOB and push a button and relay that to the car, then a separate vulnerability to replicate the key action as well. As their is no information transmitted without physical action by the owner, it isn't at all the same. The Tesla FOB automatically unlocks with proximity, and requires no KEY to then drive off at that point.
The Tesla system (used by a couple other luxary cars as well) just requires the hackers to be close to the car for a few seconds, then close to the key for a few seconds. As the car constantly sends out a challenge to the key, they record that, then play that challenge to the FOB, after 2 valid responses they can duplicate the FOB as they have generate a 2Tb lookup to catch the key code. After that point they have everything needed to operate the car normally without any contact with the original fob again.
They do have a Fix, if the owner purchases a better FOB, then software can protect this with a larger encryption key. Relay attacks without touching the original FOB would still work. Tesla now allows owners to have a password to start the car. Personally I would rather have a key, than having to carry a FOB, and enter a password each time to be as secure.
Are you afraid of writing "fob"?
"The attack is particularly significant because Tesla pioneered the keyless entry concept..."
I have a 2011 Nissan Altima that has a no-contact in-your-pocket key fob. Did Nissan license the technology from Tesla (since they "pioneered it")?
Remember that FOBs are not a key. If the concern is getting into the car, you don't want to FOB. Understand that FOBs are an added layer on the car and key that is NOT going to get you anywhere near the car. I had all my keys as FOBs, but went years without getting into the car. Found out though that FOBs are like car hack - mine had to go, but hacking to get the car open isn't the most efficient thing to do. You can call a FOB safe, but that takes billions of man hours to get though. Blank clones? I found that the movie theaters are at "I just cloned you at the door." VERY horrifying. You might as well take in the movie in front of the candy machine.
https://www.amazontedx.com/bes...
No it doesn't. The problem here is not just that you can unlock the car, it's that you can recover the secret key and make a duplicate key. Then you can start and drive the car all you like, access it whenever you want rather then just once.
Not sure what this claim about Tesla pioneering keyless entry in the summary is either. Lots of cars had it long before Tesla came along.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Wait.
No.
It does not.
All these systems have cryptographic exchanges. Just because one specific imlimentation of it contained a flaw that allows an attacker to gain a access to the secret key doesn't mean that all systems have the same flaw. Unless you're implying in an industry where everyone reinvents everything and designs everything custom to themselves suddenly thought it was a great idea to standardise on one code base for keyfobs.
There've been other keyless access issues with other companies before as well. I remember reading some article about a guy keeping his key fob in an altoid tin or whatever after someone with a range extender of some kind that let them open his car door several days in a row. Apparently it could be used next to his car (parked in the street) and replicate the signal from the fob a decent distance away.
Now I look forward to this same writer having an article about his fob breaking due to being filled with altoid dust.
Nothing of what I can imagine have been invented by or pioneered by Tesla. Keyless entry have been used long before Tesla existed, so?
Someone other than the dealer.
Apparently Tesla keyless driving is a bit different from what you're referencing:
And as pointed by others in this thread, not the keyless system that was affected by the current vulnerability.
The vulnerability affects the classical fob-based keyless system, that has been available for ages from countless others manufacturer.
Thus the parent is right (and the summary is wrong), Tesla hasn't been the one pioneering the affected keyless system.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"Starting" an EV is actually bringing all the systems up, waking up the onboard computers, usually performing some self diagnostics (mostly of the lithium battery), re-engaging some systems (is several cars, reportedly in Teslas too, the lithium battery can be shut off for safety and isolation, the computer runs out of secondary lead battery) (The power inverter running the motor is similarly shut off in most cars), and unlock a few stuff (steering lock).
It's closer to what your laptop performs when brought out of suspend mode, than what an ICE does when starting.
i.e.: "Starting" is make the car ready to drive.
But unlike an ICE vehicle, the motor doesn't start to purr constantly. The electrical motor will only start turning if you press the accelerator pedal.
Though it's extremely fast on most cars (a couple of seconds of self-diagnostic), some manufacturers like Tesla might already do as you approach the car, so you can simply enter and hit the accelerator.
Also regarding the question about clutch, there's no physical clutch in an EV: the motor is connected to the differential with a fixed ratio.
On most cars, there's still a "gear selector"-like lever with Reverse/Neutral/Forward position similar to automatic cars.
But this actually isn't controlling any physical device, it's electronically defining the behavior of the vehicle.
(e.g.: which direction the motors spins when the accelerator pedal is pushed).
Also, because electic motors only use fixed gear ratio and go in reverse by spinning the motor the otherway around, it means that nothing will physically limit the speed of the car in *reverse* the motor could spin as fast forward as backward.
(Unlike an ICE, where the motor constantly spins in a single direction, and only has 1 single gear going in reverse. You can't shift to a "2nd gear reverse" to go any faster, unlike when going forward with 5 or 6 gears).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Being pedantic, I have corrected the subject.
Pedant refers to a person that is pedantic. So your subject was meaning enable the pedantic mode of the person.
All you need is a SDR transciever and some decent programming skills. All you need to do is record the bitstream from the car to the fob and the fob to the car.
VW pioneered the technology, not Tesla. The problem is the data is not encrypted. They don't implement public and private keys. A more sophisticated approach would be to seed public key. Only the CAR and FOB would have the current public key. I am not going to tell you how to break in. I can tell you it's easy.
Keyless entry is easy too. Similar to open a door but you would need a key for the ignition for a standard keyless entry.
A fob.. well if you record a fob / car data stream, you can easily unlock the car and drive it.
Can somebody tell me why a radio signal detector couldn't unlock the car initially by just range extending it to the parking lot without the owner knowing??
What happens if while driving the car the key is thrown out of the window? (or the range extender stops?)
Democracy Now! - uncensored, anti-establishment news
Why wouldn't they use a challenge-response system so that it can't be replayed?