Bluetooth hack compromises Teslas, digital locks, and more

[peterfd]

Has anyone has any theft issues because of this Bluetooth "link layer relay attack"?

Technical Advisory – Tesla BLE Phone-as-a-Key Passive Entry Vulnerable to Relay Attacks

Vendor: Tesla, Inc. Vendor URL: Versions affected: Attack tested with vehicle software v11.0 (2022.8.2 383989fadeea) and iOS app 4.6.1-891 (3784ebe63). Systems Affected: Attack tested on Model 3. M…

research.nccgroup.com

Bluetooth hack compromises Teslas, digital locks, and more | Digital Trends

Security researchers have found a way to circumvent digital locks and security systems that rely on Bluetooth fobs and smartphones for authentication.

www.digitaltrends.com

 

[Tam]

Has anyone has any theft issues because of this Bluetooth...

It was really easy, quick and very popular to steal Tesla in seconds with traditional fob (non-bluetooth) that's not next to the car in Europe. The fob can be far away in a bedroom and the Tesla is parking outside of the house.

Thieves in the US should be able to update their annual Continuing Education Creditals by learning that trick from Europe but there's no similar reports in the US.

That stealing stopped when Tesla offered PIN to drive.

Now, Tesla has a Bluetooth version and looks like it's the same method as if it's non-bluetooth: No need to figure out the encryption, just relay the signal intact.

So, guess what's the counter measure would be this time?

Yes, the old fashion PIN to drive. Destroying your fobs and phones would achieve the same objective.

 

[ay221]

 

[sorbl]

The attack is targetted: it requires one attacker near the victim's phone and one attacker near the victim's car. (And they need to communicate over wifi or cellular data.) That's not a scenario I'm super-worried about (if the attackers are that dedicated, they can probably find other, easier, ways to steal from me).

FWIW, the attack could be mitigated if the Tesla App used the phone's GPS to verify that the phone is, indeed, in close proximity to the car (instead of merely assuming that it is, because they are "communicating" over bluetooth).

 

[Tam]

...one attacker near the victim's phone...

The demo didn't say how near is near but for this video, it's 20 meters away. That's 65.6 feet!

If the car is on the driveway at home and the phone is in the bedroom, most likely it's within 65.6 feet.

The old fashion way of relaying a fob was demoed 3 years ago:

 

[sorbl]

The demo didn't say how near is near but for this video, it's 20 meters away. That's 65.6 feet!

If the car is on the driveway at home and the phone is in the bedroom, most likely it's within 65.6 feet.

Mmmm. IIUC, the phone has to be far enough away from the car that it's not connected via bluetooth to the car. That means two attackers ...

20 meters is really far for a bluetooth connection. 10m is more typical range. Your point is well-taken, though: "near" need not be all that near.