4 ms·

The headline on this had me very confused; surely not even Tesla would implement something like this without a crypto challenge-response in there somewhere? Th

The headline on this had me very confused; surely not even Tesla would implement something like this without a crypto challenge-response in there somewhere? They did not. This attack relies on 2 devices: one next to the car and one next to the phone. It is tunneling the bluetooth link, but you still need an authorized phone at the other end of the tunnel (to respond to the crypto challenge). EDIT: it had me confused because I saw "Relay Attacks" and parsed it as "Replay Attacks". Now getting more coffee ...

jeroenhd 4y ago
This is quite a traditional attack going back years at this point. It's also incredible effective and regularly used by car thiefs across the world. The hardware thiefs use to execute the attack sometimes differs per brand or model so it's not a universal attack per se, but leaked data sets about car ownerships make it easy to get a good return on investment for even just a repeater that only works on a single model. These automatically unlocking keys should really be stored in a Faraday cage while not in use. When it comes to phones, well, disable Bluetooth when you're not near your car if you've set up this functionality, I guess…
- darkerside 4y ago
  > These automatically unlocking keys should really be stored in a Faraday cage while not in use. Those things aren't bullshit? I thought these attacks could only be used while your key was in use.
  - AshamedCaptain 4y ago
    Some keys supposedly have an accelerometer and will stop emitting if the are not moving, but I really have no idea if this is mainstream or a legend. Myself, I have never seen any key that would stop emitting.
    - tomalpha 4y ago
      Ford made a big thing of this a couple of years back[0]. Don't know how many of their models now have it though. [0] https://www.ford.co.uk/support/how-tos/keys-and-locks/door-locks-and-alarms/how-does-the-motion-sensing-key-fob-work https://www.ford.co.uk/support/how-tos/keys-and-locks/door-l...
    - jimmaswell 4y ago
      If you have to pick the thing up anyway, then why not just make it need a button press to transmit anything and eliminate this attack?
      - taeric 4y ago
        This is more convenient than it sounds. Carrying your kid back to the car from a day at the park? Just get close and you can easily open the door. No having to put the kid down so that you can find your keys in whatever bag/pocket they were placed in.
    - taeric 4y ago
      Even if true, this isn't really much of a help. Sure, they won't steal from you while in your house. Maybe, as many folks keep their keys in pockets until bed. But, that aside, just go hang out at a grocery store. It is rather hilarious how basic threat modeling can basically shore this up as way more impossible to do fool proof than you'd think. You may think "put biometrics/camera" on car so that it can see who is trying to open it. Suddenly valets and kids can't open cars for you. Turn off when key is lost? See plenty of takes on that in this conversation.
  - jeroenhd 4y ago
    It all depends on the type of key your car comes with. Some have protections to ensure that they only transmit when they're supposed to, but many, if not most, can be tricked into transmitting when they're not. Personally, I'd err on the safe side and use one of those EM blocking pouches just in case.

jeroenhd 4y ago

This is quite a traditional attack going back years at this point. It's also incredible effective and regularly used by car thiefs across the world. The hardware thiefs use to execute the attack sometimes differs per brand or model so it's not a universal attack per se, but leaked data sets about car ownerships make it easy to get a good return on investment for even just a repeater that only works on a single model. These automatically unlocking keys should really be stored in a Faraday cage while not in use. When it comes to phones, well, disable Bluetooth when you're not near your car if you've set up this functionality, I guess…

darkerside 4y ago
> These automatically unlocking keys should really be stored in a Faraday cage while not in use. Those things aren't bullshit? I thought these attacks could only be used while your key was in use.
- AshamedCaptain 4y ago
  Some keys supposedly have an accelerometer and will stop emitting if the are not moving, but I really have no idea if this is mainstream or a legend. Myself, I have never seen any key that would stop emitting.
  - tomalpha 4y ago
    Ford made a big thing of this a couple of years back[0]. Don't know how many of their models now have it though. [0] https://www.ford.co.uk/support/how-tos/keys-and-locks/door-locks-and-alarms/how-does-the-motion-sensing-key-fob-work https://www.ford.co.uk/support/how-tos/keys-and-locks/door-l...
  - jimmaswell 4y ago
    If you have to pick the thing up anyway, then why not just make it need a button press to transmit anything and eliminate this attack?
    - taeric 4y ago
      This is more convenient than it sounds. Carrying your kid back to the car from a day at the park? Just get close and you can easily open the door. No having to put the kid down so that you can find your keys in whatever bag/pocket they were placed in.
  - taeric 4y ago
    Even if true, this isn't really much of a help. Sure, they won't steal from you while in your house. Maybe, as many folks keep their keys in pockets until bed. But, that aside, just go hang out at a grocery store. It is rather hilarious how basic threat modeling can basically shore this up as way more impossible to do fool proof than you'd think. You may think "put biometrics/camera" on car so that it can see who is trying to open it. Suddenly valets and kids can't open cars for you. Turn off when key is lost? See plenty of takes on that in this conversation.
- jeroenhd 4y ago
  It all depends on the type of key your car comes with. Some have protections to ensure that they only transmit when they're supposed to, but many, if not most, can be tricked into transmitting when they're not. Personally, I'd err on the safe side and use one of those EM blocking pouches just in case.