Tesla Theft

[Foucault]

There was an FCC filing a couple of months ago showing Tesla are working on a new key fob that uses ultra wide band to allow time of flight positioning. This should make relay attacks all but impossible as the car will be able to figure out where the key is based on its response to the car. It should be possible to do the same in the app for phones that support UWB, though these tend to be recent high end phones. There’s more details here Tesla is working on new key fob with auto unlocking 'immune to relay attacks' - Electrek

 

[Mrklaw]

with my previous BMW I left the keys close to the front door but hidden from sight. Assuming if someone breaks in they can have it - I'd rather they take the car than come upstairs looking for the key. But with the model 3 I have no key (cards are in my wallet I guess). Maybe they'll just take the wife's polo and call it a day? Any of you leave a key card downstairs just in case?

I agree about protecting from them coming in, but if they're in I want them out without getting aggressive. If they want the car they can have it, thats what insurance is for

 

[Avendit]

with my previous BMW I left the keys close to the front door but hidden from sight. Assuming if someone breaks in they can have it - I'd rather they take the car than come upstairs looking for the key. But with the model 3 I have no key (cards are in my wallet I guess). Maybe they'll just take the wife's polo and call it a day? Any of you leave a key card downstairs just in case?

I agree about protecting from them coming in, but if they're in I want them out without getting aggressive. If they want the car they can have it, thats what insurance is for

The normal thieves we get nick cars, but only cause it's easy. I don't think they would know what a key card was if you left it in plain sight.

We were broken into couple of years ago (pre Tesla, fast Leon was away with us, they just got the wife's 1.2 swift, recovered with no damage). One of the team had an ankle bracelet tracker on. Not the smartest bunch.

 

[MrBadger]

I'm not really sure why people do not use PIN to drive. It just seems a no brainer to me and takes less time to activate than putting a key in the lock of most cars. The only negative point if you have a car full of people that you may not want to disclose the PIN to, but there are other slightly less easy ways to avoid the need to enter the PIN in front of a car full.

 

[davidmc]

I'd hope that Tesla could stop a reported stolen car from supercharging using the ID given in the handshake. That would surely make it fairly worthless when trying to sell it on. Only good for parts... but then who's in the market for Tesla parts... not many places even do work on them apart from Tesla.

It wont be the value in a car or its spare parts (such as bumpers, wing mirrors etc), its will be about the value in its battery pack. At the moment i think each pack is roughly valued at around £10k for a LRM3. So its rich pickings to the right mob that has the right tools. And im afraid its not about "will it happen", it more about "when will it happen". Soon they will get hold of a manual and understand how to remove this quickly and then dump the rest in some farmers field.

Although before this, i see EV Charge cables will be the next catalytic converter thefts (£150 each) - So if a thief could relay your Key Fob/Phone and unlock you car boot, the pin to drive is not going to stop the cable/UMC going!

 

[JVINFL]

Mate of mine had his BMW stolen a few years ago. They broke into his house while the family was asleep, found his key on the kitchen table and left with the car. Imagine the same scenario if he had had PIN to drive. Would they have given up or gone mental and done something stupid? Who knows? His view at the time was that he was glad they found the key and just took the car. Nobody got hurt. It was just a car and fully insured anyway.

So my view is if someone is prepared to go as far as breaking into your house while you are asleep then it's better if they find what they are looking for and leave asap before things potentially get really ugly. For that reason I don't use PIN to drive at home. I'd rather they just took the car in that scenario. But I don't make it too easy for them either e.g. relay attack wouldn't work.

Regarding the sim. When Teslas were getting stolen before PIN etc, disabling the sim was very easy to avoid tracking. I think most of those cars ended up being broken up and sold as parts. But as you say, it's now far easier to steal Range Rovers and BMWs. Anyone coming for your Tesla in the dead of night is likely to be an opportunist or deranged nutter rather than a professional car thief who is fully aware of the technical issues.

Very glad no one was hurt over a car. That is what God made insurance for. Here in the US, at least in many states someone coming into your home is highly unlikely. Between the alarm, armed family and the canine they would not have the opportunity to search for much let alone get near the windows or door. The idea is to make you the least favorable target.

 

[Irata]

Are the battery packs not "coded" to the car? Like car radios use to be. If not, they should be.

Anything to make things more difficult.

 

[Adopado]

Are the battery packs not "coded" to the car? Like car radios use to be. If not, they should be.

Anything to make things more difficult.

The packs with all their support electronics may well be but the packs can be divided up ... most EV projects don't use full packs "as is" ... I believe. Also switch cells with electronics etc. There is a mistaken belief that all thieves are idiots. Not all thieves are uninformed and in some cases the level of knowledge and expertise is quite extensive. It's an unfortunate reality that certain aspects of the back street car industry have always had a number of seriously dodgy members. (The "coded" car radios was a case in point ... the sharing of methods for re-setting them was rife.)

 

[Irata]

The packs with all their support electronics may well be but the packs can be divided up ... most EV projects don't use full packs "as is" ... I believe. Also switch cells with electronics etc. There is a mistaken belief that all thieves are idiots. Not all thieves are uninformed and in some cases the level of knowledge and expertise is quite extensive. It's an unfortunate reality that certain aspects of the back street car industry have always had a number of seriously dodgy members. (The "coded" car radios was a case in point ... the sharing of methods for re-setting them was rife.)

In which case, I'd call that broken up for parts then.

 

[Adopado]

In which case, I'd call that broken up for parts then.

Of course.

 

[HenryT]

Between the alarm, armed family and the canine they would not have the opportunity to search for much let alone get near the windows or door. The idea is to make you the least favorable target.

Even the dog's got a gun?

 

[Adopado]

Even the dog's got a gun?

It'll be a gun dog with a hound gun ...

(I'll get my coat ...)

 

[HenryT]

It'll be a gun dog with a hound gun ...

(I'll get my coat ...)

* Taxi for Mr Adopado....

 

[Irata]

Linking nicely from taxi

If we do imagine this robotaxi fleet, I can also imagine a scenario where a car is booked using a stolen means of payment to a remote location it can discretely be stolen for parts. Tape over the cameras, disconnect the HV battery, into a trailer. Given no threat to life, I can't see the police responding instantly even if it did call for help.

 

[BushtrimmmerJr]

Linking nicely from taxi

If we do imagine this robotaxi fleet, I can also imagine a scenario where a car is booked using a stolen means of payment to a remote location it can discretely be stolen for parts. Tape over the cameras, disconnect the HV battery, into a trailer. Given no threat to life, I can't see the police responding instantly even if it did call for help.

Looks like we’ve got a prime suspect if that does happen.

 

[Lickrob]

How does Bluetooth mitigate relay attacks? Is there a maximum time permitted in some form of challenge-response? Google/Wikipedia fails me....

I'm not sure on how Relay and Bluetooth works. But the Model 3 Key fob turns off the bluetooth signal completely if it has been still for a period of time vs a phone key which is always on.

 

[MadScientist]

I don’t use pin-to-drive at home but I have configured my phone to turn off Bluetooth during the night and also that it can’t be re-enabled without unlocking my phone. It would therefore be useless as a key if stolen during the early hours.

 

[Cnixon]

Disclaimer: I work in it security, and have for 20 years now (ok, that's a scary sentence).

Don't get distracted by the wrong things. Locks and handles don't help, unless what you have currently is made of paper. You might be thinking 'they will never get through this quadruple deadlocked door, bwhahaha', but they are thinking 'yup, still just glass in this window'. It's the asymmetry of the defender - you have to defend all routes in, they just have to find one weak point.

So instead of over defending one point, make sure you have a consistent level of defence round the whole ground floor, close windows and do t leave keys visible from a window. In our area, they tend to break through patio doors and take 6 mins to grab jewelry and a car key then head off. Put either somewhere that it will take more than 6 mins to find and you kind of win. Use insurance to cover the gap.

In terms of the cars, there is a bit of a mix in the thread, old info and currant mixed up, and s/X/3 mixed too. Defender and attacker are always in a battle, each reacting to the steps the other takes. As I understand it, the current situation is:

• S & X, with the updated fob code from last year, currently can't be relayed.
• 3, using Bluetooth, can't practically be relayed currently. I have seen some stories from the US of people sleeping very close to their car (ie next room beside or above the garage) allowing the car to be driven off, so if this is you, experiment and take precautions if needed.
• Pin to drive is a good defence against your phone, key card or fob being physically stolen at any point, home or away.

I would add that you should make sure your phone has a pin/fingerprint/faceID etc set, has remote wipe enabled and you know how to initiate that process. My phone is my paranoia point as it has almost everything on it, but worse it has my email which is how all (most anyway) the password resets can be done.

And its probably got the Authenticator app installed, which has really improved things, but is useless if phone is insecure.

 

[Cnixon]

I'm not really sure why people do not use PIN to drive. It just seems a no brainer to me and takes less time to activate than putting a key in the lock of most cars. The only negative point if you have a car full of people that you may not want to disclose the PIN to, but there are other slightly less easy ways to avoid the need to enter the PIN in front of a car full.

Before 2FA I think pin to drive was dubious if you gave your username and password to any app which asked - I felt that way. With app installed and logged in 'they' could find you anywhere and get in authorise (from car screen) remote start and turn on car from app.

Now...I think I will go activate PIN to drive!

 

[NewbieT]

The counter argument to PIN to drive is car hacking. Want to be threatened with a weapon while you type in your pin or just hand over the car? I know my preference. Agree with the need for good physical basic security precautions and cyber security passwords etc.

re: M3 relay. My point is it is *possible*, not necessarily likely or widespread.