7 ms·
Tesla gets stolen with keyfob hack on camera in seconds
- hanche 7y agoOne can get RF blocking pouches for the keyfob. It’s a cheap countermeasure; a bit inconvenient, though.
- deleted 7y ago[deleted]
- unityByFreedom 7y agoif you know about this issue I guess you just go back to regular keys
- WalterBright 7y agoAnother advantage to an old car. Mechanical keys, and a gearshift :-)
- hvidgaard 7y agoA gearshift is only a deterrent in the US. In EU I think everyone has to get their license in a manual.
- Lukas_Skywalker 7y agoSwitzerland recently changed the law so people that passed the exam on an automatic are now allowed to drive manual transmissions as well. Seems slightly crazy to me.
- adrianN 7y agoIn Germany at least you can get your license in an automatic car, but then you're not allowed to drive manual cars.
- dagw 7y agoEU I think everyone has to get their license in a manual. Several countries in the EU have automatic only drivers licenses, but hardly anybody gets them since being forbidden from driving a manual car is a pretty significant limitation.
- lrem 7y agoThey don't have to. But getting your license in an automatic means you are limited to pretty much hybrids/electrics.
- hvidgaard 7y agoIn that case I'd rather just plugin the fob... I have to get it out of the pouch anyway, so I'd rather not bother with it at all.
- vkou 7y agoYou're better off just popping the battery out, and using the keyfob in passive mode.
- natch 7y agoThe newer Tesla keyfobs don’t emit RF unless you either click a button, or are inches away from the RFID reader on the driver door pillar. Maybe could still be defeated with a very long range RFID reader? I don’t know how long range they get.
- labawi 7y agoI read about ~1m boosting, though not sure what type of technology it was. It might still be a good idea to limit time-of-flight to eliminate relay attacks.
- sansnomme 7y agoAre Tesla seriously that bad at crypto that they can't prevent a replay attack? A time-based MAC (Message Authentication Code) system like those used by bank 2FAs can go quite a long way. You just have to resync the clock when you change the battery. E.g. See Tuomas Aura's most excellent paper: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.69.1965&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.69....
- cbanek 7y agoThe article said it's a relay attack, not a replay attack: https://hackernoon.com/signal-amplification-relay-attack-sara-609ce6c20d4f https://hackernoon.com/signal-amplification-relay-attack-sar...
- sdflhasjd 7y agoIt's not a replay attack, it's a relay attach where the signal is amplified further than the usual range of the keyfob.
- jackvalentine 7y agoWhy are cars with keyfobs like this designed to be able to keep driving when the keyfob goes out of range?
- sparky_z 7y agoGenuine question: does the keyfob depend on a battery that can run out? If so, there's your answer.
- dewey 7y agoHaving to rely on some wireless connection to stay connected while driving doesn’t sound like a good idea.
- arethuza 7y agoProbably so you can still drive the car even if you manage to lose the key from the car while it is being driven. And yes, I do have an unfortunate personal experience to support this theory :-)
- Erlich_Bachman 7y agoThere is a regulation that says that the car can't just stop driving mid-drive. It's just basic safety common sense - imagine car shutting down on a highway because the key battery died or there was a radio interference.
- breakingcups 7y agoWould you rather run the risk of a car turning off on a busy highway when the communication gets interrupted for any reason whatsoever?
- 2rsf 7y agoIsraeli thieves (well, mostly Palestinians) are already over that- they open a door (or smash a window), open the hood and in seconds change the car's computer with one the bring with them. Insurance companies try to fight that by forcing the installation of a "safe" around the computer
- pontifier 7y agoVery interesting seeing how this attack is performed. I'd imagine that future keyfobs would use a time of flight based system of call and response to prevent this sort of thing.
- sdflhasjd 7y agoSomething like a gyro/accelerometer could ensure the keyfob is on a person, and not just sitting on a table.
- pontifier 7y agoNot a perfect solution. Keys are sometimes set down in the vehicle before starting. A time based rule (motion within last x) won't help because sitting in a non-running car is something that happens often enough that keys not working would be a problem. Also, someone could steal your car while you have your keys in your pocket inside your house, or walking around a store.
- SAI_Peregrinus 7y agoOr just a cryptographic challenge/response. No range limitations like time-of-flight, protects against replay, cheap with appropriate hardware. And since key fobs are custom hardware anyway (and typically expensive!) the <1$ crypto ICs I've used like the Microchip ATECC608 could be added to implement it with minimal price increase.
- purple_ducks 7y ago> Or just a cryptographic challenge/response This was a relay attack. Not a re_p_lay attack. It's just amplifying the signal from the outside car to the inside keys & vice versa.
- dagw 7y agoThis was a headline in all the Swedish newspapers a few days ago. Apparently a gang of car thieves has been sweeping through parts of the country and stealing dozens of Teslas in a very short time span.
- soup10 7y agoi think i saw that movie...
- patrickreyesdev 7y agoThe bus that couldn't slow down
- m_eiman 7y agoI don't understand how anyone in a security role in the car industry can accept a system like this that's been broken and abused for years. Is the convenience of not having to push a button on the key fob as you approach the car really worth the risk of having it stolen fairly easily?
- codedokode 7y agoCar security systems always were this unreliable. Earlier systems were vulnerable to replay attacks or had weak encryption. I think they are made to protect against random person walking by, not a professional and well-equipped attacker.
- tomatocracy 7y agoUltimately a professional can just turn up with a trailer and load the car onto it if they are really determined. Deterring the more casual end of theft is the right solution. What’s happened is that the accessibility of the technology to undertake eg replay or relay attacks has increased so that’s now become a more casual theft vector. It’s a cat and mouse game.
- panpanna 7y ago> Car security systems always were this unreliable. Not all of them. Some have really really good security. And security regulation for car security is coming worldwide in 2021, thanks to the "terrorist threat".
- ec109685 7y agoWhat happens the next time they want to start the car?
- anextomp 7y agoOnce you have unlimited physical access to the hardware, software protections are worthless. And that's ignoring that it could just be sold for parts.
- function_seven 7y agoWhat car? You mean that pile of ready-to-fence parts over there? And the big-ass battery that’ll fetch $4,000? And those seats that I just listed on eBay? ;)
- ladberg 7y agoApple Watches can be used to unlock MacBooks and are immune to relay attacks like these because the laptop only accepts signals with a small enough roundtrip latency. Due to the speed of light, it's impossible to unlock it from farther than a few feet away, even with a relay. Why don't key fobs do the same thing? It must take more expensive radios/hardware, but I feel like it would be worth it for a car like a Tesla.
- pushpop 7y agoIt’s worth it for any car when you think about how much more expensive they are than a laptop.
- ralfd 7y agoIt is comfortable though to lock/unlock a car from a few meters away.
- unityByFreedom 7y agoIs it necessary to start it from far away?
- yellow_postit 7y agoremote start has long been a nice comfort feature for cars especially in cold regions/weather so the car can start warming up before you get to it.
- reallydontask 7y agoSame applies to hot regions/weather and cooling down the car's interior. Not fun getting into a car that's been in the sun most of the day when the temperature is 40°C
- labawi 7y agoReasonable, though the engine on Tesla has no relation to heating.
- dkaleta 7y agoWhen you unlock your Mac with an Apple Watch, the OS makes sure the watch is actually close to it by measuring the distance it takes the signal to travel to the device. Why won't car manufactures do that? Is there any reason? https://bgr.com/2016/06/27/macos-auto-unlock-security-apple-watch/ https://bgr.com/2016/06/27/macos-auto-unlock-security-apple-...
- Kiro 7y agoWhat prevents the thieves from just standing closer in that case?
- icebraining 7y agoThe signal still has to travel from the car to the authentic key, the thieves are just amplifying the signal, they can't make it faster.
- natch 7y agoEveryone commenting on this should be aware that Tesla has different generations of keyfob technology. The Model 3 keyfobs for instance make a different tradeoff with convenience versus security, being slightly less convenient and way more secure. The car in the story was a Model S.
- makomk 7y agoThe main problem with the earlier Tesla keyfobs is that they used a known-broken 40-bit encryption scheme that allowed them to simply be cloned by an attacker. I'm not sure what they fixed other than upgrading the crypto to something that wasn'y horribly insecure. That's also the reason they introduced the PIN feature.
- HyperTalk2 7y agoStupid motherfucker Elon with his TNG obsession can go fuck his own dick until it rots and falls off. Fuck your worthless touchscreens that no one EVER asked for, you aren't cool and you aren't invincible. Shove your first mover advantage up your ass you literal nobody. Grimes isn't even interesting, she's a generic ugly and unhealthy white girl with a soundcloud account. Who the FUCK cares lol meanwhile we're all judging you for being such a simp. Pathetic balding insect. Go fuck yourself you fucking fake weeb and balding midlife crisis motherfucker whose dick probably doesn't even work anymore without pills. I know you're reading this comment you vermin, suck my dick you garbage leftover pile of carbon that was once a human. I was sent by God to track your progress and you're really not impressing us at all. Believe it or not my reach is greater than yours, you inferior speck. Soon you will pay for your insolence. Why does twitter even exist anymore? You could have built a successful competitor in exchange for a fraction of 1% of your net worth but you didn't even try. You're a failure. Failure. Failure. Failure. Failure. Elon Musk the Failure. Elon Musk the Failure. Elon Musk the Failure. Elon Musk the Failure. Elon Musk the Failure. PATHETIC lmao
- nikita2206 7y agoWow! If this is DL-generated then I’m very much impressed.
- dang 7y agoWe've banned this account since you've ignored our request to use HN as intended. If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future.
- retSava 7y agoWhile I really hate that this attack is even possible, a nice feature with a car manufacturer that regularly and often update the software/firmware is this: "In response to those attacks, Tesla started rolling out [...] If an owner activates the “PIN to Drive” function [...] anyone entering the car will have to know your PIN in order to be able to drive away." And why wouldn't the car (all vulnerable cars) deactivate when it one minute later (or X meters) doesn't detect the key in the car? Ie do a second poll of the key.
- tomatocracy 7y ago> And why wouldn't the car (all vulnerable cars) deactivate when it one minute later (or X meters) doesn't detect the key in the car? Ie do a second poll of the key This has been a solved problem for some time in luxury/expensive vehicles. Vehicle tracking systems detect if the car is moved without the tracking card in it and silently inform their control centre of the fact, along with vehicle’s location. Control centre then calls owner and verifies if it’s them. Doing it this way has the advantage that if the driver is being threatened (carjacking for example), it doesn’t put them at further risk.
- dagw 7y agoAt least in the recent case of Tesla thefts here in Sweden the car thieves also blocked/disabled the GPS tracking before driving away so tracing the cars was impossible.
- dagw 7y agoAnd why wouldn't the car (all vulnerable cars) deactivate when it one minute later (or X meters) doesn't detect the key in the car? Probably a safety vs security concern. They don't want your car to suddenly die on you in the middle of the highway if your keyfob battery dies.
- fmajid 7y agoWhat I can’t believe is why the carmakers are not liable for the loss since their locks use such piss-poor cryptography.
- kiallmacinnes 7y agoTo me, locks of any kind are just a deterrent, they aren't meant to be impossible to circumvent, there just meant to deter casual thieves. Should Yale be responsible for all the stuff stolen from a house after someone picks the lock? I don't think so.
- Crosseye_Jack 7y agoDepends on how they advertise that lock imo. If a locks manufacturer market a lock to be secure giving it a 8 out of 10 rating but that lock could be decoded without any tools in a very short period of time then I believe that the manufacturer should bear some responsibility. But then again Master Lock still exist lol... Take the 174SSD for example. Master Lock list it for $38 so not a bargain basement lock. They say it’s “best for“ For: Residential Gates & Fences, Sheds, Workshops, Garages, Storage Lockers, Tool Chests, Tool Boxes[0], the packaging boasts about its security[1] and yet it can be quickly decoded without tools[2]. Now I’m sure the people on this site are aware of the quality of Master Lock but is your avg Joe walking into the hardware store? IMO there is a point where your performance can’t back up your marketing you become libel. But in Tesla’s case I don’t think they market the security of their keyless entry/start. I would say they are aware of the security risks of the tech and is why they released an OTA update that enables the need of a passcode to start the car. The question for me then becomes, If Tesla we’re aware of this risk and added a protection against it but didn’t advise customers of the risks of keyless entry/start and the protections against it enough could they have at least a little liability? OTA Cuts both ways, Yes it allows for easy updating in the field, but it also provides a direct communication point with your customer to be able to advise them of "such new information". [0] https://www.masterlock.com/personal-use/product/174SSD https://www.masterlock.com/personal-use/product/174SSD [1] https://imgur.com/a/iaffVut https://imgur.com/a/iaffVut [2] https://youtu.be/CTLY4b3sG9E https://youtu.be/CTLY4b3sG9E EDIT: Cleared up some spelling (fucking auto correct). But I would also like to make it clear that I wouldn't expect a lock manufacturer to always be responsible for the items the lock is "protecting". For an example: You put a high security lock of your front door to protect your home, A burglar cases your joint and instead of picking the lock which will take too much time they break a window and enter your home though that instead. The lock did its job so I couldn't hold the manufacturer responsible at all. My gripe is when weak locks, or locks with known defects are being sold to the general public as "secure". If a car manufacturer said their car was safe in a crash, giving themselves a high safety score but it found out that "safe" meant that it was only deemed safe under lab conditions were the impact was at exactly 55mph but in the real world a defect meant it was hit and miss that the airbags would actually deploy in the event of a collision people would be up in arms about it, lawsuits filed, recalls issued, etc. I don't expect any lock to be 100% secure (nor any car 100% safe in a collision) but when the marketing team for a manufacturer take it on themselves to talk up the security then I don't think its wrong to expect that manufacturer to held to account when their claims don't hold up.
- roelschroeven 7y agoI'm glad my car has a keyfob that I can easily turn off. Relay attacks don't work then. In fact I'd much rather have a keyfob where I have to push a button to unlock the car; I don't really see how not having to push a button adds all that much convenience.
- Crosseye_Jack 7y agoWhen you are wrangling your kids and your keys are in a bag somewhere. Just one instance of not having to push a button could be a convenience. Not that I disagree that I much prefer having keyless entry disabled on my car. Just giving a situation where I could see keyless as being more convenient because I’m an argumentative little shit ;-)