5 ms·

This has happened so many times (I've heard of at least 5) in the UK to Tesla cars that Tesla themselves sent out a warning with instructions on how to turn off

This has happened so many times (I've heard of at least 5) in the UK to Tesla cars that Tesla themselves sent out a warning with instructions on how to turn off the passive entry feature that allows this attack. https://pasteboard.co/HypzOWg.png https://pasteboard.co/HypzOWg.png Here's a video of a relay theft (of a Merc) from West Midlands police in the UK... https://www.west-midlands.police.uk/news/4544/watch-police-release-footage-relay-crime https://www.west-midlands.police.uk/news/4544/watch-police-r... Photo from a camera of attempted theft, from a UK Tesla owner... https://pasteboard.co/HypF8Ep.jpg https://pasteboard.co/HypF8Ep.jpg

maym86 8y ago
Maybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.
- jasoncartwright 8y ago
  Many suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.
  - maym86 8y ago
    Sure. Was just trying to solve the problem while keeping the same experience, which some automotive manufacturers must think is worth providing to customers.
  - gambiting 8y ago
    If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.
    - matthewdgreen 8y ago
      It's coming in the next generation of keyless systems: https://www.3db-access.com/ https://www.3db-access.com/
      - Rjevski 8y ago
        I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.
        leot 8y ago
        Why not relay that, too?
        Rjevski 8y ago
        Relaying would still require the owner to push a button on the keyfob, right?
        maym86 8y ago
        No. The point of this whole thread is there is no button so that when you approach the car it unlocks automatically. That's why this attack is possible by extending the range with repeaters. The key likely already has something similar to what you suggested but that can't prevent this attack.
        giobox 8y ago
        The entire point, rightly or wrongly, of keyless entry is that you never have to touch the key, simply have it somewhere in the vicinity of the car, such as in your pocket. No button pressing or user input. You approach the car and it is already magically unlocked and ready to be started, usually via a starter button on the dash. Therefore the same concerns regarding relaying still apply, unless I’ve misunderstood your reply, but your later post suggests pressing a button on a key. If buttons on the key are pressed, this ceases to be “keyless” as the car industry understands it - this is back to conventional remote locking.
  - raverbashing 8y ago
    Well, for some people, pulling the parking brake is a "massive inconvenience" which ends up having serious consequences. Technology can't solve everything.
- tbrock 8y ago
  The attacker could just wait outside your house for you to hold or move it as you head off to work in the morning then come back at night to pick the car up
  - maym86 8y ago
    It doesn't work like that. This can't be recorded and replayed later. This attack works by extending the range of the exchange between car and key in real time using handheld repeaters.
- hvidgaard 8y ago
  The entire idea of passive keyless entry is that you just have the keyfob in your pocket, and can enter the car as you approach it without touching your keyfob. That also means that relay attack is always going to work. So either accept the risk or disable the feature.

maym86 8y ago

Maybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.

jasoncartwright 8y ago
Many suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed. Not a massive inconvenience.
- maym86 8y ago
  Sure. Was just trying to solve the problem while keeping the same experience, which some automotive manufacturers must think is worth providing to customers.
- gambiting 8y ago
  If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet? I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.
  - matthewdgreen 8y ago
    It's coming in the next generation of keyless systems: https://www.3db-access.com/ https://www.3db-access.com/
    - Rjevski 8y ago
      I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again. Seems like à solved problem really.
      - leot 8y ago
        Why not relay that, too?
        Rjevski 8y ago
        Relaying would still require the owner to push a button on the keyfob, right?
        maym86 8y ago
        No. The point of this whole thread is there is no button so that when you approach the car it unlocks automatically. That's why this attack is possible by extending the range with repeaters. The key likely already has something similar to what you suggested but that can't prevent this attack.
      - giobox 8y ago
        The entire point, rightly or wrongly, of keyless entry is that you never have to touch the key, simply have it somewhere in the vicinity of the car, such as in your pocket. No button pressing or user input. You approach the car and it is already magically unlocked and ready to be started, usually via a starter button on the dash. Therefore the same concerns regarding relaying still apply, unless I’ve misunderstood your reply, but your later post suggests pressing a button on a key. If buttons on the key are pressed, this ceases to be “keyless” as the car industry understands it - this is back to conventional remote locking.
- raverbashing 8y ago
  Well, for some people, pulling the parking brake is a "massive inconvenience" which ends up having serious consequences. Technology can't solve everything.
tbrock 8y ago
The attacker could just wait outside your house for you to hold or move it as you head off to work in the morning then come back at night to pick the car up
- maym86 8y ago
  It doesn't work like that. This can't be recorded and replayed later. This attack works by extending the range of the exchange between car and key in real time using handheld repeaters.
hvidgaard 8y ago
The entire idea of passive keyless entry is that you just have the keyfob in your pocket, and can enter the car as you approach it without touching your keyfob. That also means that relay attack is always going to work. So either accept the risk or disable the feature.