5 ms·

At what point will we finally come to the understanding that "Disable all antennas/basebands" feature is sorely needed?

ainiriand 6y ago
While I fully share your concern, it is worth noting that no Tesla so far has been stolen using techniques like this one. But many cars have been stolen just by tampering with the lock. As a nascent technology for cars as is this one, it is expected to have some flaws. I imagine that when locks were designed they were not the securest thing in world to protect your stuff. Of course we can do better in terms of security, there is always room to improve. It looks like there is a great flaw here that could get a fix, but I would not dismiss this technology just because of this. Where there is a lock there will always be a key.
- nullifidian 6y ago
  Losing a car isn't exactly my concern. You can do many other things with the ability to inject code into car computers.
  - ainiriand 6y ago
    What would happen if someone tampers with your brakes one night that you park in the street? Or with your assisting driving system? I think we have to ultimately put our faith into the fact that other people do not want to get us killed.
    - somehnguy 6y ago
      > I think we have to ultimately put our faith into the fact that other people do not want to get us killed. That’s how the roads operate in general. Someone could easily swerve into your lane and cause a head on collision at any time. Or in the case that they only have a desire to harm others there are nearly limitless possibilities to what someone could do to the shared roads. Most of the time I’m shocked that driving is as safe as it is really.
    - throwaway894345 6y ago
      One would hope that brakes, driving system, and other critical functions are firewalled off from the keyless entry system. Perhaps you were speaking about a more general, purely hypothetical attack vector?
    - ggreer 6y ago
      Is there any car on the road today that doesn't use hydraulic brakes? Sure the braking force is boosted by a pump, but even in the event of total electrical failure, pressing the brake pedal will push fluid through hydraulic lines and engage the calipers.
    - throwaway0a5e 6y ago
      Nobody does that crap though. Vengeful exes don't have the means. People with the means leverage it to make money.
- sp332 6y ago
  Failing to check the signature on the firmware is not some tricky logic bug. It is a simple oversight that should have been caught by routine automated testing. This shows they do not have even minimal QA controls in place. Also, as GP mentioned, a physical switch that disables Bluetooth on the key fob when the owner isn't actively using it would make this attack much harder.
- shi314 6y ago
  As cars become more like IoT devices on wheels, these nascent technologies would lead to more security issues than a simple key lock mechanism. Just imagine getting locked into a car with glass you can't break (like in cybertruck) and getting asked to pay a ransom to get it unlocked.
  - rafram 6y ago
    Won’t be a problem as long as you bring along an emergency rock [1]. [1]: https://youtu.be/BqGf8pqCZi0 https://youtu.be/BqGf8pqCZi0
  - jsight 6y ago
    > Just imagine getting locked into a car with glass you can't break (like in cybertruck) and getting asked to pay a ransom to get it unlocked. If there is no threat of force, just wait the attacker out. If there is a threat of force (for example, the attacker has a gun), then you would have been just as bad off without some crazy movie-plot attack involving your door locks.
  - hajile 6y ago
    Unbreakable? https://youtu.be/LMWwImDX3ks?t=24 https://youtu.be/LMWwImDX3ks?t=24
- ClumsyPilot 6y ago
  > no Tesla so far has been stolen using techniques like this Maybe they were, we don't actually know.
  - sp332 6y ago
    That's true, since the attack lets someone sync their own key fob to any Tesla, they could have been taken for joyrides without the owner necessarily noticing.
    - filoleg 6y ago
      Wrong on multiple levels. 1. If someone synced a new keyfob or phone to their Tesla, it would show up on the owner's phone as a new car key added + it would also show up in the car menu. 2. They could've taken it for joyrides, but there is no way the owner wouldn't notice. The current car position is always updated in the app, the range it was driven is updated in the car, and the charge consumption is easy to display. It would be weird to see that the car is driving miles and miles without me operating it. And that's not even mentioning all the other "normal" things that would be noticeable, like charge levels being off, car positioning, etc.
wojciii 6y ago
Cars need flight mode .. but it should be called something else. Perhaps tunnel mode? :)
_ph_ 6y ago
Quite some time ago, Tesla introduced the "pin to drive" feature, where you can set up a pin required to drive the car. So thieves might get into the car but without the pin, they can't drive even in the presence of the correct keys.

While I fully share your concern, it is worth noting that no Tesla so far has been stolen using techniques like this one. But many cars have been stolen just by tampering with the lock. As a nascent technology for cars as is this one, it is expected to have some flaws. I imagine that when locks were designed they were not the securest thing in world to protect your stuff. Of course we can do better in terms of security, there is always room to improve. It looks like there is a great flaw here that could get a fix, but I would not dismiss this technology just because of this. Where there is a lock there will always be a key.

nullifidian 6y ago
Losing a car isn't exactly my concern. You can do many other things with the ability to inject code into car computers.
- ainiriand 6y ago
  What would happen if someone tampers with your brakes one night that you park in the street? Or with your assisting driving system? I think we have to ultimately put our faith into the fact that other people do not want to get us killed.
  - somehnguy 6y ago
    > I think we have to ultimately put our faith into the fact that other people do not want to get us killed. That’s how the roads operate in general. Someone could easily swerve into your lane and cause a head on collision at any time. Or in the case that they only have a desire to harm others there are nearly limitless possibilities to what someone could do to the shared roads. Most of the time I’m shocked that driving is as safe as it is really.
  - throwaway894345 6y ago
    One would hope that brakes, driving system, and other critical functions are firewalled off from the keyless entry system. Perhaps you were speaking about a more general, purely hypothetical attack vector?
  - ggreer 6y ago
    Is there any car on the road today that doesn't use hydraulic brakes? Sure the braking force is boosted by a pump, but even in the event of total electrical failure, pressing the brake pedal will push fluid through hydraulic lines and engage the calipers.
  - throwaway0a5e 6y ago
    Nobody does that crap though. Vengeful exes don't have the means. People with the means leverage it to make money.
sp332 6y ago
Failing to check the signature on the firmware is not some tricky logic bug. It is a simple oversight that should have been caught by routine automated testing. This shows they do not have even minimal QA controls in place. Also, as GP mentioned, a physical switch that disables Bluetooth on the key fob when the owner isn't actively using it would make this attack much harder.
shi314 6y ago
As cars become more like IoT devices on wheels, these nascent technologies would lead to more security issues than a simple key lock mechanism. Just imagine getting locked into a car with glass you can't break (like in cybertruck) and getting asked to pay a ransom to get it unlocked.
- rafram 6y ago
  Won’t be a problem as long as you bring along an emergency rock [1]. [1]: https://youtu.be/BqGf8pqCZi0 https://youtu.be/BqGf8pqCZi0
- jsight 6y ago
  > Just imagine getting locked into a car with glass you can't break (like in cybertruck) and getting asked to pay a ransom to get it unlocked. If there is no threat of force, just wait the attacker out. If there is a threat of force (for example, the attacker has a gun), then you would have been just as bad off without some crazy movie-plot attack involving your door locks.
- hajile 6y ago
  Unbreakable? https://youtu.be/LMWwImDX3ks?t=24 https://youtu.be/LMWwImDX3ks?t=24
ClumsyPilot 6y ago
> no Tesla so far has been stolen using techniques like this Maybe they were, we don't actually know.
- sp332 6y ago
  That's true, since the attack lets someone sync their own key fob to any Tesla, they could have been taken for joyrides without the owner necessarily noticing.
  - filoleg 6y ago
    Wrong on multiple levels. 1. If someone synced a new keyfob or phone to their Tesla, it would show up on the owner's phone as a new car key added + it would also show up in the car menu. 2. They could've taken it for joyrides, but there is no way the owner wouldn't notice. The current car position is always updated in the app, the range it was driven is updated in the car, and the charge consumption is easy to display. It would be weird to see that the car is driving miles and miles without me operating it. And that's not even mentioning all the other "normal" things that would be noticeable, like charge levels being off, car positioning, etc.

wojciii 6y ago

Cars need flight mode .. but it should be called something else. Perhaps tunnel mode? :)

_ph_ 6y ago

Quite some time ago, Tesla introduced the "pin to drive" feature, where you can set up a pin required to drive the car. So thieves might get into the car but without the pin, they can't drive even in the presence of the correct keys.