3 ms·

I mean, that's not the methodology of the attack... if the methodology I described were used the attack would not be possible. You are saying it is not possible

by saurik 4y ago

I mean, that's not the methodology of the attack... if the methodology I described were used the attack would not be possible. You are saying it is not possible to implement this mechanism on BLE without affecting the user's experience and, if someone had tried for this key, they wasted their time as they didn't understand how BLE worked. While I am honestly skeptical of that--as I would expect I could use a different packet with a new local timestamp for each of these "reconnections"--I don't know much about BLE, and so am willing to take your word for it; but, as we clearly aren't going to want to synchronize the clock between the car and a silly little key fob so accurately as to allow us to deal with the time difference of the speed of light moving across a mere parking lot, the conclusion to me is that we can not use BLE (which I would think is overkill for a key anyway) and instead must use a more trivial radio scheme.

dotancohen 4y ago
> a more trivial radio scheme Which would require hardware not available in typical - or low-end - consumer smartphones.
- potatochup 4y ago
  Interestingly enough, apple has UWB on some of their newer phones, which would make these attacks a lot harder. https://developer.apple.com/nearby-interaction/ https://developer.apple.com/nearby-interaction/ I imagine you would use UWB for the location, and BLE for authentication/data transfer though.
potatochup 4y ago
Tesla uses BLE for their keyfobs as well. They probably just didn't consider it worth it to add additional hardware to prevent these attacks, especially when it has to be compatible with your average consumer smartphone back in 2017 (model 3 release date). You could have two separate radio systems, one for the keyfob, and one for the phone (and then correlate the phones GPS with the measured location), but that sounds expensive and complicated. BLE has some other mechanisms for determining the proximity of a device, such as Time of Flight (ToF) and Angle of arrival (AoA). I'm unsure if Tesla uses these, or if the reachers were able to circumvent them. Time-of-flight: https://software-dl.ti.com/simplelink/esd/simplelink_cc2640r2_sdk/2.30.00.28_new/exports/examples/rtos/CC2640R2_LAUNCHXL/blestack/tof_initiator/README.html https://software-dl.ti.com/simplelink/esd/simplelink_cc2640r... Angle of arrival: https://dev.ti.com/tirex/explore/node?node=AOSUfCXMkNaUAy6wny0b2w__pTTHBmu__LATEST https://dev.ti.com/tirex/explore/node?node=AOSUfCXMkNaUAy6wn...

by saurik 4y ago

dotancohen 4y ago

> a more trivial radio scheme Which would require hardware not available in typical - or low-end - consumer smartphones.

potatochup 4y ago
Interestingly enough, apple has UWB on some of their newer phones, which would make these attacks a lot harder. https://developer.apple.com/nearby-interaction/ https://developer.apple.com/nearby-interaction/ I imagine you would use UWB for the location, and BLE for authentication/data transfer though.

potatochup 4y ago

Tesla uses BLE for their keyfobs as well. They probably just didn't consider it worth it to add additional hardware to prevent these attacks, especially when it has to be compatible with your average consumer smartphone back in 2017 (model 3 release date). You could have two separate radio systems, one for the keyfob, and one for the phone (and then correlate the phones GPS with the measured location), but that sounds expensive and complicated. BLE has some other mechanisms for determining the proximity of a device, such as Time of Flight (ToF) and Angle of arrival (AoA). I'm unsure if Tesla uses these, or if the reachers were able to circumvent them. Time-of-flight: https://software-dl.ti.com/simplelink/esd/simplelink_cc2640r2_sdk/2.30.00.28_new/exports/examples/rtos/CC2640R2_LAUNCHXL/blestack/tof_initiator/README.html https://software-dl.ti.com/simplelink/esd/simplelink_cc2640r... Angle of arrival: https://dev.ti.com/tirex/explore/node?node=AOSUfCXMkNaUAy6wny0b2w__pTTHBmu__LATEST https://dev.ti.com/tirex/explore/node?node=AOSUfCXMkNaUAy6wn...