9 ms·

Researchers demo Bluetooth relay attack against Tesla

90 points by whiteyford 4y ago

speedster123 4y ago
I wonder if this affects all electric vehicles?
- artificial 4y ago
  Here’s a fun one: https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patt...
- mrlambchop 4y ago
  Only electric vehicles that support unlock via BLE proximity. However, it will impact all electric locks that support this very same functionality as its a fundamental limitation of how BLE is implemented on cell phones. Trying to be more prescriptive on the latency or other parameters under the locks control will make the user experience significantly more frustrating and unreliable, crippling the feature.
- speedgoose 4y ago
  No, it’s not related to the power train but the keyless entry equipment. Not all electric cars have this, even less using Bluetooth.
- boblivion 4y ago
  Some car manufacturers are employing ultra wide band for precise location. The VW ID.4 for example has this. I'm not aware of successful (relay) attacks against these kind of systems.
gernb 4y ago
I guess if you had a partner, someone could be in the parking lot looking for teslas being parked, then a partner could tail that person and relay over cellular to the first standing near the car? I'm wondering what the point of this attack is. Any thief who wants in my car will just bust the windows. If they do the relay attack they can steal the car but the car has GPS and can be locked down remotely so it seems like a high risk low reward crime?
- ffhhj 4y ago
  To leave something in the car without the owner noticing?
  - totetsu 4y ago
    Or take something
- zionic 4y ago
  This dawned on me the other day, if someone hopped in my Tesla and drove away I’m not sure I could do anything in the app to hinder them. Maybe set valet mode? Best I could do there is cap it to 50
  - paxys 4y ago
    Turns out your car is, in fact, a car.
    - zionic 4y ago
      The way the app works though with the default setup leaves it unlocked/ready to go until you walk a considerable distance away. I could see thieves eventually figuring that out.
  - philips 4y ago
    You can add a PIN as a second factor. See PIN to drive in the manual https://www.tesla.com/ownersmanual/modely/en_us/GUID-94B0E05E-F642-4C8E-8FED-E5EB45FA27DA.html https://www.tesla.com/ownersmanual/modely/en_us/GUID-94B0E05...
    - Operyl 4y ago
      > If the touchscreen is still unresponsive, you can still bypass PIN to Drive by turning on Keyless Driving in the Tesla mobile app. Isn't this what the research team is abusing? If so, make sure that's turned off too!
mackman 4y ago
Can someone please help me understand how using a relay device defeats proximity detection by time of flight? It’s not like the relay device can talk to the remote device faster than the speed of the original signal.
- cma 4y ago
  It isn't doing time of flight, but just getting under a latency threshold that these devices use as a cutoff to try and avoid things like this relay attack. They say they got the added delay somewhere below 8ms to defeat the system. In 8ms, light/radio travels around 2500km.
  - BluSyn 4y ago
    Could latency/time-of-flight threshold be reduced to determine proximity? Requires very accurate clocks on both ends, and support in the wireless cards. Apple developed something similar for Apple Watch unlock on MacOS [1]. [1] https://networkingnerd.net/2016/09/21/apple-watch-unlock-802-11ac-and-time/ https://networkingnerd.net/2016/09/21/apple-watch-unlock-802...
    - saurik 4y ago
      I don't see why you need an accurate clock on both ends, you simply need a precise clock on one end (which can be the car): do a challenge/response where the car sends the key a question and requires the answer back within the very short period of time. The key in that case doesn't need a clock at all.
      - potatochup 4y ago
        This is exactly the kind of methodology the attack in the article uses though. BLE peripheral devices are usually allowed to miss connection events to preserve battery life, and to increase the reliability of the connection in noisy environments. The attack exploits the ambiguity between "the transmission was intercepted and relayed with an additional 8ms" and "the phone/keyfob skipped a connection event". Allowing no missed connection events would probably make the system frustratingly unreliable as you'd constantly be re-connecting and re-authenticating with the phone/keyfob.
agrippanux 4y ago
Maybe Tesla should focus on some hardcore hardware and software engineering
- halfmatthalfcat 4y ago
  They aren't?
crusty 4y ago
Chromebooks have a similar 'unlock with phone' feature but add that the phone must be unlocked - basically utilizing the biometrics of the phone to unlock the computer regardless of biometric hardware presence. It also uses a pretty tight proximity radius (<0.5 meters I'd guess). But if someone could combine this relay exploit with social engineering to get the target to unlock their phone (like an incoming text/notification), maybe that would get computer access. Perhaps there's a more complex handshake that takes place but if not, seems valuable.
- Gigachad 4y ago
  Apple has a nice solution to this. If you have the watch unlock feature on, your watch will notify you of an unlock and provide a button to relock which disables the feature temporarily. It’s likely not completely bullet proof but if you are up against such sophisticated attacks then it’s reasonable to say just don’t use these features.
davidhyde 4y ago
> “BLE proximity authentication systems typically measure the distance of a device by the response time, so if the device is too far away from the device to be unlocked, the response time will be too long and the authentication won’t work.” > “The tool that researchers at NCC Group developed adds just 8 milliseconds of latency in the response time” Radio waves propagate at the speed of light so a signal can travel about 2400 km in 8ms. I think there are some key aspects of the Bluetooth le proximity auth protocol that the article is missing which makes the whole thing sound like nonsense. I think the real reason that Bluetooth le proximity authentication is broken is that it is a passive communication protocol. They do hint at this in the article. Imagine how broken TLS would be if there was no two way communication to negotiate proofs.
- arghwhat 4y ago
  Not only that, their test was conducted at a paltry distance of 25 meters between authentication device and vehicle - only barely outside the normal range of the device. If they wanted to prove that they had bypassed the range limit with their relay device, they should relay the authentication over a few kilometers rather than a few meters.
- AshamedCaptain 4y ago
  Bluetooth LE is not "passive" in the sense that there is definitely two way communication going on. They even mention GATT in the article and that is as two-way as it gets.
- wizee 4y ago
  Devices don’t use GATT response latency to estimate distance, but elevated levels of GATT latency are commonly used as indications of relay attacks. A lower latency relay attack can work around this defence. The researcher recommends time-of-flight measurement in a secure ranging protocol to mitigate such attacks.
k_sze 4y ago
This is not even the first time, if we look at the car industry. Possibly different wireless protocol, but same idea: proximity without (tight-enough) time-of-flight check. How has Tesla not learned the lesson?
- bipson 4y ago
  They are very proud of the fact that they don't follow other's "lessons learned" - because Elon assumes everyone else is an idiot and their assumptions suck. Sometimes he's right. Often he is not. Several dramatic "defects" of Tesla's could have been prevented - but why should Tesla care? "Bring it in for a fix!" they say. "It is not our money! Haha!" they say. And investors and buyers keep coming.
- manicdee 4y ago
  What lesson is there to learn? Why do you single out Tesla? The title is wrong, this is a generic attack against BLE.
  - k_sze 4y ago
    Relay attacks (not specific to BLE) had been demonstrated at least more than 3 years ago: https://news.ycombinator.com/item?id=18608452 https://news.ycombinator.com/item?id=18608452 The lesson should have been to 1) pick or come up with an adequate protocol that includes tight time-of-flight checks or 2) not use proximity auth at all, if it is impossible to mitigate against relay attacks, in terms of physics and maths. I'm saying Tesla's engineers should have known better, by 1) paying attention to news in the industry; and 2) properly understanding BLE before choosing it as the auth protocol.
sergiosgc 4y ago
I'd implement two mitigation features ASAP: 1. Disable the ability to unlock the car if the phone has been stationary for a while. No more siphoning authentication from a phone in the night stand. 2a. Setup phone presence inside the car as a second authentication factor for starting the car. BMWs can detect if the key is inside or outside the car; I imagine the same positioning can be detected out of a bluetooth+wifi+nfc radio source. 2b. If phone positioning would require extra hardware, an alternative is using phone NFC as authentication (I think the keycard is NFC, so the hardware should be present)
- lgrebe 4y ago
  In response to previous reports of this in 2018 tesla added a „pin to drive“ option. When enabled, an unlocked car needs a second authentication in form of a pin code the user had previously set up https://insideevs.com/news/339271/tesla-adds-new-pin-to-drive-security-feature/ https://insideevs.com/news/339271/tesla-adds-new-pin-to-driv...
Rygian 4y ago
Tesla provides (two-step) Multi-Factor Authentication to be able to drive the car: - Unlock the car via BLE. Not able to drive away. - Enter a PIN-to-drive on car screen, to turn on the virtual ignition. Able to drive away. Unfortunately, the PIN to drive is not enabled by default. Pin-to-drive can be bypassed through the Tesla mobile app, and this bypass is not relayed to the car via BLE but rather via the link between car and Tesla servers. Therefore, someone with proximity to a locked phone can unlock the car, and someone with access to an unlocked phone can unlock the car and drive away.
- bin_bash 4y ago
  PIN to drive is so annoying to use. I had it enabled when I lived in Oakland to avoid a potential car-jacking but I could not wait to turn it off when I moved out of California.
- stevehawk 4y ago
  If I'm going through the effort to do BLE relay.. then I can probably go through the effort to watch you enter a PIN through a camera lense though, right? (I'm not familiar with how Tesla's actually work)
  - riffraff 4y ago
    I recall videos from years ago of people opening up a car via relay of proximity keys, recorded via some security camera. They literally just walked up with an antenna close to a house and the car parked in front of it opened. It's _very_ different from spying on someone to steal their PIN.
    - Handytinge 4y ago
      I believe this is the relevant video (amusingly with a Tesla next to it): https://youtu.be/uxzm_6SYBFo https://youtu.be/uxzm_6SYBFo
pikseladam 4y ago
Do you know why this website is so fast? Can any help me to find out their back-end? Thank you
- Sohcahtoa82 4y ago
  It's fast because it's not loading 100 JavaScript files from 15 different trackers and 20 ad providers. Also, the content is loaded statically, rather than having to wait for some JS to load that then loads and renders the article text. It takes effort to make a site slow, not the other way around.

90 points by whiteyford 4y ago

speedster123 4y ago

I wonder if this affects all electric vehicles?

artificial 4y ago
Here’s a fun one: https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patty https://github.com/HackingIntoYourHeart/Unoriginal-Rice-Patt...
mrlambchop 4y ago
Only electric vehicles that support unlock via BLE proximity. However, it will impact all electric locks that support this very same functionality as its a fundamental limitation of how BLE is implemented on cell phones. Trying to be more prescriptive on the latency or other parameters under the locks control will make the user experience significantly more frustrating and unreliable, crippling the feature.
speedgoose 4y ago
No, it’s not related to the power train but the keyless entry equipment. Not all electric cars have this, even less using Bluetooth.
boblivion 4y ago
Some car manufacturers are employing ultra wide band for precise location. The VW ID.4 for example has this. I'm not aware of successful (relay) attacks against these kind of systems.

gernb 4y ago

I guess if you had a partner, someone could be in the parking lot looking for teslas being parked, then a partner could tail that person and relay over cellular to the first standing near the car? I'm wondering what the point of this attack is. Any thief who wants in my car will just bust the windows. If they do the relay attack they can steal the car but the car has GPS and can be locked down remotely so it seems like a high risk low reward crime?

ffhhj 4y ago
To leave something in the car without the owner noticing?
- totetsu 4y ago
  Or take something
zionic 4y ago
This dawned on me the other day, if someone hopped in my Tesla and drove away I’m not sure I could do anything in the app to hinder them. Maybe set valet mode? Best I could do there is cap it to 50
- paxys 4y ago
  Turns out your car is, in fact, a car.
  - zionic 4y ago
    The way the app works though with the default setup leaves it unlocked/ready to go until you walk a considerable distance away. I could see thieves eventually figuring that out.
- philips 4y ago
  You can add a PIN as a second factor. See PIN to drive in the manual https://www.tesla.com/ownersmanual/modely/en_us/GUID-94B0E05E-F642-4C8E-8FED-E5EB45FA27DA.html https://www.tesla.com/ownersmanual/modely/en_us/GUID-94B0E05...
  - Operyl 4y ago
    > If the touchscreen is still unresponsive, you can still bypass PIN to Drive by turning on Keyless Driving in the Tesla mobile app. Isn't this what the research team is abusing? If so, make sure that's turned off too!

mackman 4y ago

Can someone please help me understand how using a relay device defeats proximity detection by time of flight? It’s not like the relay device can talk to the remote device faster than the speed of the original signal.

cma 4y ago
It isn't doing time of flight, but just getting under a latency threshold that these devices use as a cutoff to try and avoid things like this relay attack. They say they got the added delay somewhere below 8ms to defeat the system. In 8ms, light/radio travels around 2500km.
- BluSyn 4y ago
  Could latency/time-of-flight threshold be reduced to determine proximity? Requires very accurate clocks on both ends, and support in the wireless cards. Apple developed something similar for Apple Watch unlock on MacOS [1]. [1] https://networkingnerd.net/2016/09/21/apple-watch-unlock-802-11ac-and-time/ https://networkingnerd.net/2016/09/21/apple-watch-unlock-802...
  - saurik 4y ago
    I don't see why you need an accurate clock on both ends, you simply need a precise clock on one end (which can be the car): do a challenge/response where the car sends the key a question and requires the answer back within the very short period of time. The key in that case doesn't need a clock at all.
    - potatochup 4y ago
      This is exactly the kind of methodology the attack in the article uses though. BLE peripheral devices are usually allowed to miss connection events to preserve battery life, and to increase the reliability of the connection in noisy environments. The attack exploits the ambiguity between "the transmission was intercepted and relayed with an additional 8ms" and "the phone/keyfob skipped a connection event". Allowing no missed connection events would probably make the system frustratingly unreliable as you'd constantly be re-connecting and re-authenticating with the phone/keyfob.

agrippanux 4y ago

Maybe Tesla should focus on some hardcore hardware and software engineering

halfmatthalfcat 4y ago
They aren't?

crusty 4y ago

Chromebooks have a similar 'unlock with phone' feature but add that the phone must be unlocked - basically utilizing the biometrics of the phone to unlock the computer regardless of biometric hardware presence. It also uses a pretty tight proximity radius (<0.5 meters I'd guess). But if someone could combine this relay exploit with social engineering to get the target to unlock their phone (like an incoming text/notification), maybe that would get computer access. Perhaps there's a more complex handshake that takes place but if not, seems valuable.

Gigachad 4y ago
Apple has a nice solution to this. If you have the watch unlock feature on, your watch will notify you of an unlock and provide a button to relock which disables the feature temporarily. It’s likely not completely bullet proof but if you are up against such sophisticated attacks then it’s reasonable to say just don’t use these features.

davidhyde 4y ago

> “BLE proximity authentication systems typically measure the distance of a device by the response time, so if the device is too far away from the device to be unlocked, the response time will be too long and the authentication won’t work.” > “The tool that researchers at NCC Group developed adds just 8 milliseconds of latency in the response time” Radio waves propagate at the speed of light so a signal can travel about 2400 km in 8ms. I think there are some key aspects of the Bluetooth le proximity auth protocol that the article is missing which makes the whole thing sound like nonsense. I think the real reason that Bluetooth le proximity authentication is broken is that it is a passive communication protocol. They do hint at this in the article. Imagine how broken TLS would be if there was no two way communication to negotiate proofs.

arghwhat 4y ago
Not only that, their test was conducted at a paltry distance of 25 meters between authentication device and vehicle - only barely outside the normal range of the device. If they wanted to prove that they had bypassed the range limit with their relay device, they should relay the authentication over a few kilometers rather than a few meters.
AshamedCaptain 4y ago
Bluetooth LE is not "passive" in the sense that there is definitely two way communication going on. They even mention GATT in the article and that is as two-way as it gets.
wizee 4y ago
Devices don’t use GATT response latency to estimate distance, but elevated levels of GATT latency are commonly used as indications of relay attacks. A lower latency relay attack can work around this defence. The researcher recommends time-of-flight measurement in a secure ranging protocol to mitigate such attacks.

k_sze 4y ago

This is not even the first time, if we look at the car industry. Possibly different wireless protocol, but same idea: proximity without (tight-enough) time-of-flight check. How has Tesla not learned the lesson?

bipson 4y ago
They are very proud of the fact that they don't follow other's "lessons learned" - because Elon assumes everyone else is an idiot and their assumptions suck. Sometimes he's right. Often he is not. Several dramatic "defects" of Tesla's could have been prevented - but why should Tesla care? "Bring it in for a fix!" they say. "It is not our money! Haha!" they say. And investors and buyers keep coming.
manicdee 4y ago
What lesson is there to learn? Why do you single out Tesla? The title is wrong, this is a generic attack against BLE.
- k_sze 4y ago
  Relay attacks (not specific to BLE) had been demonstrated at least more than 3 years ago: https://news.ycombinator.com/item?id=18608452 https://news.ycombinator.com/item?id=18608452 The lesson should have been to 1) pick or come up with an adequate protocol that includes tight time-of-flight checks or 2) not use proximity auth at all, if it is impossible to mitigate against relay attacks, in terms of physics and maths. I'm saying Tesla's engineers should have known better, by 1) paying attention to news in the industry; and 2) properly understanding BLE before choosing it as the auth protocol.

sergiosgc 4y ago

I'd implement two mitigation features ASAP: 1. Disable the ability to unlock the car if the phone has been stationary for a while. No more siphoning authentication from a phone in the night stand. 2a. Setup phone presence inside the car as a second authentication factor for starting the car. BMWs can detect if the key is inside or outside the car; I imagine the same positioning can be detected out of a bluetooth+wifi+nfc radio source. 2b. If phone positioning would require extra hardware, an alternative is using phone NFC as authentication (I think the keycard is NFC, so the hardware should be present)

lgrebe 4y ago
In response to previous reports of this in 2018 tesla added a „pin to drive“ option. When enabled, an unlocked car needs a second authentication in form of a pin code the user had previously set up https://insideevs.com/news/339271/tesla-adds-new-pin-to-drive-security-feature/ https://insideevs.com/news/339271/tesla-adds-new-pin-to-driv...

Rygian 4y ago

Tesla provides (two-step) Multi-Factor Authentication to be able to drive the car: - Unlock the car via BLE. Not able to drive away. - Enter a PIN-to-drive on car screen, to turn on the virtual ignition. Able to drive away. Unfortunately, the PIN to drive is not enabled by default. Pin-to-drive can be bypassed through the Tesla mobile app, and this bypass is not relayed to the car via BLE but rather via the link between car and Tesla servers. Therefore, someone with proximity to a locked phone can unlock the car, and someone with access to an unlocked phone can unlock the car and drive away.

bin_bash 4y ago
PIN to drive is so annoying to use. I had it enabled when I lived in Oakland to avoid a potential car-jacking but I could not wait to turn it off when I moved out of California.
stevehawk 4y ago
If I'm going through the effort to do BLE relay.. then I can probably go through the effort to watch you enter a PIN through a camera lense though, right? (I'm not familiar with how Tesla's actually work)
- riffraff 4y ago
  I recall videos from years ago of people opening up a car via relay of proximity keys, recorded via some security camera. They literally just walked up with an antenna close to a house and the car parked in front of it opened. It's _very_ different from spying on someone to steal their PIN.
  - Handytinge 4y ago
    I believe this is the relevant video (amusingly with a Tesla next to it): https://youtu.be/uxzm_6SYBFo https://youtu.be/uxzm_6SYBFo

pikseladam 4y ago

Do you know why this website is so fast? Can any help me to find out their back-end? Thank you

Sohcahtoa82 4y ago
It's fast because it's not loading 100 JavaScript files from 15 different trackers and 20 ad providers. Also, the content is loaded statically, rather than having to wait for some JS to load that then loads and renders the article text. It takes effort to make a site slow, not the other way around.