Other person opening our car trunk accidentally

[Ruester]

Another Model 3 owner, had his identical Model 3 (same color & wheel covers as ours) parked 50 feet from our car. He walked up to OUR car and, with his cell phone app, successfully opened OUR trunk and OUR driver's side door. Fortunately we were walking just 30 feet behind him to witness it. I then tried opening his car door - to no avail) Has anyone else experienced this? and if so, any solutions?

 

[srs5694]

I've heard of that sort of thing happening with physical keys. In fact, it happened to me once -- I accidentally opened another Saturn's trunk when mine was parked a few spaces down. This is the first I've heard of it happening with Teslas and their phone-as-key functionality, though, and I find it surprising that it would happen at all; as I understand it, the "keying" is based on Bluetooth addresses, which are (or at least, should be) unique, and there's no such thing as "close enough" when it comes to a matching address. That said, there have been successful demonstrations of "hacks" of Teslas' phone-as-key functionality (see here, for instance; but there have been other reports). There's a chance that the other Tesla owner was playing with such a technique, you caught him in the act, and he dissembled about it -- but then again, Hanlon's Razor may apply here ("never attribute to malice that which is adequately explained by stupidity" -- or in this case, a software bug). In any event, I do have some suggestions for "hardening" your vehicle:

• Apply PIN-to-drive -- This feature requires you to enter a number before you can drive the car. See the Tesla owner's manual for details.
• Remove unnecessary keys -- Every key (key card, key fob, or phone) that the car recognizes is a potential threat, either because somebody might steal a key or because of overlap (an accidental duplication of Bluetooth addresses, for instance).
• Use an RFID-blocking wallet -- If you keep your key card on your person, store it in an RFID-blocking wallet. This will reduce the risk of an RFID-cloning attack on your car.
• Lock your rear seats -- I haven't heard much about this recently, but soon after the Model 3 was introduced, there were news stories about thieves breaking the small pane of the rear window to unfold the rear seat to see if there was anything valuable in the trunk. If the thief spotted valuables, a bigger window would then be broken so as to gain full entry and steal the trunk's contents. In response, various third parties started selling locks for the rear seats, typically accessible only from within the trunk, along with stickers to put on the rear windows to warn thieves that this trick will be useless. This obviously won't help with the sort of electronic access problem you've reported, but I thought it worth adding to the list.

 

[stopcrazypp]

Another Model 3 owner, had his identical Model 3 (same color & wheel covers as ours) parked 50 feet from our car. He walked up to OUR car and, with his cell phone app, successfully opened OUR trunk and OUR driver's side door. Fortunately we were walking just 30 feet behind him to witness it. I then tried opening his car door - to no avail) Has anyone else experienced this? and if so, any solutions?

How did you know it was not your key that that unlocked it? As long as your key is in proximity, he can push the door handle and open the door, same thing with the trunk button on the car. His car may be still be out of range of his key or not awake yet, so may not have responded.

Or do you mean he pressed the cell phone app button and it opened your trunk (without him ever touching the trunk button on the car)? The comment about the door doesn't make sense however in this context, given AFAIK the app can't remote release the door (you have to pull the handle).

 

[Ruester]

How did you know it was not your key that that unlocked it? As long as your key is in proximity, he can push the door handle and open the door, same thing with the trunk button on the car. His car may be still be out of range of his key or not awake yet, so may not have responded.

Or do you mean he pressed the cell phone app button and it opened your trunk (without him every touching the trunk button on the car)? The comment about the door doesn't make sense however in this context, given AFAIK the app can't remote release the door (you have to pull the handle).

I appreciate all the responses.
Nothing sinister happening.
Fyi, his wife’s arms were full of packages and he popped our trunk open with his phone remotely. He did not touch our car. That’s when they noticed it was not their car. At this point we were standing about four cars away where we could see each other and both looked mutually shocked. We then locked our car again and walked away to test it — he was able to walk up and open OUR driver-side door.
We do have a code to enter before driving, so that was not an issue. Still does not make sense that he could get into OUR car, but we could not get into HIS car.

 

[Ruester]

I've heard of that sort of thing happening with physical keys. In fact, it happened to me once -- I accidentally opened another Saturn's trunk when mine was parked a few spaces down. This is the first I've heard of it happening with Teslas and their phone-as-key functionality, though, and I find it surprising that it would happen at all; as I understand it, the "keying" is based on Bluetooth addresses, which are (or at least, should be) unique, and there's no such thing as "close enough" when it comes to a matching address. That said, there have been successful demonstrations of "hacks" of Teslas' phone-as-key functionality (see here, for instance; but there have been other reports). There's a chance that the other Tesla owner was playing with such a technique, you caught him in the act, and he dissembled about it -- but then again, Hanlon's Razor may apply here ("never attribute to malice that which is adequately explained by stupidity" -- or in this case, a software bug). In any event, I do have some suggestions for "hardening" your vehicle:

• Apply PIN-to-drive -- This feature requires you to enter a number before you can drive the car. See the Tesla owner's manual for details.
• Remove unnecessary keys -- Every key (key card, key fob, or phone) that the car recognizes is a potential threat, either because somebody might steal a key or because of overlap (an accidental duplication of Bluetooth addresses, for instance).
• Use an RFID-blocking wallet -- If you keep your key card on your person, store it in an RFID-blocking wallet. This will reduce the risk of an RFID-cloning attack on your car.
• Lock your rear seats -- I haven't heard much about this recently, but soon after the Model 3 was introduced, there were news stories about thieves breaking the small pane of the rear window to unfold the rear seat to see if there was anything valuable in the trunk. If the thief spotted valuables, a bigger window would then be broken so as to gain full entry and steal the trunk's contents. In response, various third parties started selling locks for the rear seats, typically accessible only from within the trunk, along with stickers to put on the rear windows to warn thieves that this trick will be useless. This obviously won't help with the sort of electronic access problem you've reported, but I thought it worth adding to the list.

Thank you for your suggestions. We do have a PIN code. See my response to another person below.

 

[stopcrazypp]

I appreciate all the responses.
Nothing sinister happening.
Fyi, his wife’s arms were full of packages and he popped our trunk open with his phone remotely. He did not touch our car. That’s when they noticed it was not their car. At this point we were standing about four cars away where we could see each other and both looked mutually shocked. We then locked our car again and walked away to test it — he was able to walk up and open OUR driver-side door.
We do have a code to enter before driving, so that was not an issue. Still does not make sense that he could get into OUR car, but we could not get into HIS car.

Being able to open the door is not unusual if your phone key was still active (unless you turned off bluetooth on all your party's phones and also made sure you had no key fobs and his key was the only one that was active for sure).

Him being able to open the trunk however from the app is unusual, regardless of it is done by LTE or bluetooth. His phone key should not be tied at all with your car. You may want to check if there are old phone keys tied to your car (not sure if somehow he has previously may have used key with car before for example if car is a used car or was rejected during delivery), but that would have to be a very big coincidence.

I presume you don't have any aftermarket mods however (like the trunk foot sensors or aftermarket motorized trunk).

 

[Ruester]

Being able to open the door is not unusual if your phone key was still active (unless you turned off bluetooth on all your party's phones and also made sure you had no key fobs and his key was the only one that was active for sure).

Him being able to open the trunk however from the app is unusual, regardless of it is done by LTE or bluetooth. His phone key should not be tied at all with your car. You may want to check if there are old phone keys tied to your car (not sure if somehow he has previously may have used key with car before for example if car is a used car or was rejected during delivery), but that would have to be a very big coincidence.

I presume you don't have any aftermarket mods however (like the trunk foot sensors or aftermarket motorized trunk).

Both cars are new and no after-market products. You do bring up a good point. I always have my Bluetooth on and will start turning it off when leaving the car parked. Thank you!

 

[Rice&Curry]

Looks like we have to have a two factor authentication for everything

 

[STS-134]

Both cars are new and no after-market products. You do bring up a good point. I always have my Bluetooth on and will start turning it off when leaving the car parked. Thank you!

That will also disable all other Bluetooth apps (including COVID exposure notifications). Instead, I simply revoke the "nearby devices" permission in Android for my Tesla app, which prevents the app from being able to communicate with the car over Bluetooth. The car won't start, nor will you be able to touch a door handle or the trunk lid and open the doors/trunk, if you are holding just my phone (because I use the keyfob). But it wouldn't stop the app from unlocking the doors or opening the trunk, which happens over LTE.

 

[Ruester]

That will also disable all other Bluetooth apps (including COVID exposure notifications). Instead, I simply revoke the "nearby devices" permission in Android for my Tesla app, which prevents the app from being able to communicate with the car over Bluetooth. The car won't start, nor will you be able to touch a door handle or the trunk lid and open the doors/trunk, if you are holding just my phone (because I use the keyfob). But it wouldn't stop the app from unlocking the doors or opening the trunk, which happens over LTE.

Good to know. Thank you!

 

[XPsionic]

I appreciate all the responses.
Nothing sinister happening.
Fyi, his wife’s arms were full of packages and he popped our trunk open with his phone remotely. He did not touch our car. That’s when they noticed it was not their car. At this point we were standing about four cars away where we could see each other and both looked mutually shocked. We then locked our car again and walked away to test it — he was able to walk up and open OUR driver-side door.
We do have a code to enter before driving, so that was not an issue. Still does not make sense that he could get into OUR car, but we could not get into HIS car.

So when he opens the trunk in his app, only your car's trunk opened but not theirs?

 

[Ruester]

So when he opens the trunk in his app, only your car's trunk opened but not theirs?

Yes, he was too far away from his car (50-60 feet) and just 3 feet from my car. When we got home, we experimented how close I needed to be to my car before my wife could manually open the trunk. I needed to be within around 6 feet of the trunk.

 

[jjrandorin]

Yes, he was too far away from his car (50-60 feet) and just 3 feet from my car. When we got home, we experimented how close I needed to be to my car before my wife could manually open the trunk. I needed to be within around 6 feet of the trunk.

Not quite sure what is being said here, since opening the trunk from the app doesnt require proximity, so this person couldnt have been "too far away" to open the trunk from the app.

 

[Ruester]

Not quite sure what is being said here, since opening the trunk from the app doesnt require proximity, so this person couldnt have been "too far away" to open the trunk from the app.

To clarify, he headed directly to OUR car, thinking it was his. He was standing next to our car when he opened our trunk. His car was parked two parking rows away (50-60 feet). We were leaving the store heading towards our car, 30-40 feet behind him. We were both shocked when he opened our trunk and realized it was not his car!

 

[jjrandorin]

To clarify, he headed directly to OUR car, thinking it was his. He was standing next to our car when he opened our trunk. His car was parked two parking rows away (50-60 feet). We were leaving the store heading towards our car, 30-40 feet behind him. We were both shocked when he opened our trunk and realized it was not his car!

At least a couple times in this thread, you said that the person opened it with their app:

He walked up to OUR car and, with his cell phone app, successfully opened OUR trunk

Fyi, his wife’s arms were full of packages and he popped our trunk open with his phone remotely.

If he opened it with the app, that doesnt require proximity (you can open the doors from a different country if you wanted to, as long as you and the car had cell signal).

If he simply walked up and pulled on the trunk, its very possible that your phone was within range for it to be connected to the car. There are multiple bluetooth radios on the car. You can test in a parking lot to see how far you can get away from the car before walk away lock activates, and sometimes its much farther than others (20-30 feet at least).

Opening it with the app is a completely different thing, and you mentioned it a couple times like thats what you tested with this other person. Did you ask them to open their app, click controls, then tap "open" on the trunk in the app? If not, then they were not opening it with the app.

 

[father_of_6]

Not quite sure what is being said here, since opening the trunk from the app doesnt require proximity, so this person couldnt have been "too far away" to open the trunk from the app.

Mind blown... I was going to chime in and agree with you, but recently received an update to the Android app so I thought I'd double check just for kicks.

Just two minutes ago, I turned off WiFi and data on my phone, but not Bluetooth. THEN I opened the app and walked out to the car. The app showed a loading animation... and said "check connection". BUT... to my surprise, standing right behind the car and pushing the app's trunk button *indeed opened the trunk*.

You heard it here first folks, the app will communicate directly with the car via Bluetooth if in proximity. I always wondered why this wasn't the case... saves LTE data.

Now that we know it, now the concerning part is that *perhaps the OP is right* that Tesla got this wrong and the app can open other cars too.

I don't have a lot of confidence in Tesla's software devs, so I wouldn't be too surprised if this were true.

 

[Ruester]

Good points, we’ll also try to talk with Tesla on this incident. Thank you!

 

[stopcrazypp]

To clarify, he headed directly to OUR car, thinking it was his. He was standing next to our car when he opened our trunk. His car was parked two parking rows away (50-60 feet). We were leaving the store heading towards our car, 30-40 feet behind him. We were both shocked when he opened our trunk and realized it was not his car!

If he was standing next to your car, that opens up the possibility he pressed the trunk button on the car previously before you were able to see (and it only working as you get in range, which may lead to confusion over what activated it). That would make a lot more sense than his app somehow gaining access to your car.

 

[stopcrazypp]

Mind blown... I was going to chime in and agree with you, but recently received an update to the Android app so I thought I'd double check just for kicks.

Just two minutes ago, I turned off WiFi and data on my phone, but not Bluetooth. THEN I opened the app and walked out to the car. The app showed a loading animation... and said "check connection". BUT... to my surprise, standing right behind the car and pushing the app's trunk button *indeed opened the trunk*.

You heard it here first folks, the app will communicate directly with the car via Bluetooth if in proximity. I always wondered why this wasn't the case... saves LTE data.

Now that we know it, now the concerning part is that *perhaps the OP is right* that Tesla got this wrong and the app can open other cars too.

I don't have a lot of confidence in Tesla's software devs, so I wouldn't be too surprised if this were true.

The trunk/frunk, unlocking/locking functions working on Bluetooth as a backup is expected functionality that has existed for a long while (I discussed it back then in an older thread).
What doesn't work when you don't have cell service or WiFi?

However, when there is a data connection available, it goes over the internet (and you can do the function literally anywhere).

As for the security, they are using bluetooth based authentication for the phone key already (which AFAIK no one has been able to break the actual keys, only relay attacks have worked), I don't see why they would not use the same for the other functions that bluetooth allows via the app.

 

[srs5694]

Fyi, his wife’s arms were full of packages and he popped our trunk open with his phone remotely. He did not touch our car.

Did you happen to notice the brand of phone he had? If it was the same as yours (any of your paired phones), that might increase the odds of the Bluetooth addresses being accidentally duplicated at the factory, which might help explain this. If his phone happened to duplicate the Bluetooth address of a phone that's paired to your car and set up as a key, but that was not the phone you tried to use, then that might also explain why yours couldn't unlock his car. Another possible explanation for this point is if his phone lacked cell or WiFi service but yours had it (because of different carriers, for instance). In that case, given what @stopcrazypp and @father_of_6 say, it's possible that your phone didn't attempt to fall back to Bluetooth but the other Tesla owner's phone did.

In fact, a simple experiment seems worth doing, involving two friends with Teslas: Person A disables WiFi and cell service on their phone, approaches Person B's Tesla (within Bluetooth range), and uses Person A's phone's Tesla app to try to unlock the car, pop the trunk, open the charge port, etc. It's conceivable that this fallback for manual unlocking was written with much-too-lax security and will work on any Tesla, much like any Supercharger, Wall Connector, or Mobile Connector will open the charge port on any Tesla. If this is the case, it's a jaw-dropping security flaw, so I hope it's not what's happening.