Time to disable bluetooth as a key?

[CaptUAL]

I have been reading allot of articles lately that say the model 3 (even the new one with UWB) are susceptable to radio relay attacks, and BLE relay attacks.
I have an older model 3 (2018). I don't think there is any fix for non-highland models?

However most articles are just repeated news (not primary source) and don't go into enough detail for me to understand the actual problem. Is the bluetooth hack actually a thing or are they talking about keyfob attacks or something else?

Is there a way to disable the bluetooth as a key option? (just delete all the bluetooth keys?).

Should I instead use the key card to unlock / lock and drive the car from now on, or is that just as susceptable if someone is using one of these relay attack devices?

Thanks!

Really Bad neighborhood? Work in a Ghetto? Play in low life locations? Why the paranoia? Park in the garage and Forget about it.

 

[rpiotro]

Not answering your question but the inconvenience of using the key card is not worth it. Use your insurance in the extremely unlikely case that someone steals your car. Not worth worrying about.

Your car is not especially valuable and other cars are easier to steal.

According to my insurance agent, as well as a friend's agent, the rule of thumb here in Massachusetts is that it will cost you more in the long run to have insurance cover the repairs if those repairs amount to less than $5000. Of course, that's assuming that you are found to be at fault for the damage. If the other guy is at fault, go ahead and let insurance cover it.

Pro tip. If the other guy is at fault don't even get your insurance involved. Make a claim with the other guys insurance. It's what I did.

 

[father_of_6]

The actual hack is a relay attack, which means someone has to get close to YOU with the relayafter they placed a device close to your car .. the relay then acts as an forwarder between your car and phone, making the car think your phone is close by and unlock. There is no easy fix to this, since it does not involve cracking encryption etc. You will have to judge the risk yourself, but its quite low unless you park your car on the street AND someone knows where you live AND they can get close enough to your phone for the relay to be effective.

Probably would take two people... one near you with a device and one near the car with a device and to open the door.

 

[terranx]

Pro tip. If the other guy is at fault don't even get your insurance involved. Make a claim with the other guys insurance. It's what I did.

Where this ends up failing is if the other guy is uninsured or underinsured. Last time someone hit one of my cars, they only had $5k coverage

 

[cubicalclang]

If you are worried, use PIN to drive.

The actual hack is a relay attack, which means someone has to get close to YOU with the relayafter they placed a device close to your car .. the relay then acts as an forwarder between your car and phone, making the car think your phone is close by and unlock. There is no easy fix to this, since it does not involve cracking encryption etc. You will have to judge the risk yourself, but its quite low unless you park your car on the street AND someone knows where you live AND they can get close enough to your phone for the relay to be effective.

Pin to drive IS the fix for this. It takes two seconds, it's still far faster than even pressing a start/stop button or turning a key.

 

[ucmndd]

Where this ends up failing is if the other guy is uninsured or underinsured. Last time someone hit one of my cars, they only had $5k coverage

Blows my mind that CA’s property damage liability minimum is only $5k. Or anywhere for that matter. Even a parking lot love tap can be more than $5k these days.

 

[drtimhill]

Pin to drive IS the fix for this. It takes two seconds, it's still far faster than even pressing a start/stop button or turning a key.

No, it's a work-around ((though a good one). A FIX would allow you to use your phone as the key without risk of this attack.

 

[drtimhill]

Probably would take two people... one near you with a device and one near the car with a device and to open the door.

My understanding is they leave the car relay on the front wheel, though you are correct two people would make the theft easier.

 

[father_of_6]

My understanding is they leave the car relay on the front wheel, though you are correct two people would make the theft easier.

Who would then open the door? A relay attack just makes the car think the driver is close by. It can't originate, for example, the "pop driver door" command.

It seems like this type of theft would require a person at the vehicle. Which means either two people, or the device near the owner is somehow following the owner automatically (e.g. planted in their pocket).

 

[drtimhill]

Who would then open the door? A relay attack just makes the car think the driver is close by. It can't originate, for example, the "pop driver door" command.

It seems like this type of theft would require a person at the vehicle. Which means either two people, or the device near the owner is somehow following the owner automatically (e.g. planted in their pocket).

No, you need two devices to make the relay .. one that is left close to the car and the other close to the owners phone. Assuming the owner is close by you can get back to the car before ti relocks. Otherwise yes you need two people, one to get in the car and start it once the door unlocks.

Protecting against these devices is tricky since you need time of flight based on timestamps buried in the devices (encrypted) and/or exchange of GPS location data. You cannot use (e.g.) BTLE time of flight since the car measures this from the device to the car, and in this case its the relay device which IS close to the car.

 

[father_of_6]

Protecting against these devices is tricky since you need time of flight based on timestamps buried in the devices (encrypted) and/or exchange of GPS location data. You cannot use (e.g.) BTLE time of flight since the car measures this from the device to the car, and in this case its the relay device which IS close to the car.

A relay attack is probably not that difficult... a pair of flipper zeroes for $170 each is probably enough to carry this out. If someone is determined enough to do this, they'll probably just follow you for a bit and watch you type your PIN to drive as well (with, for example, binoculars). I'd say it takes two people to pull off... one at the car and the other close enough to the driver. Trying to plan the second device on the driver is how you get caught.

Pickpocketing someone's key is another option for people into stealing cars. So is the "Kia Challenge", which I believe is pretty easy to pull off and definitely less expensive than two flipper zeroes. Of course, neither of those methods gets you a Tesla.

I use PIN to drive, and I also lock my bike up. People with bolt cutters can still steal the bike, and two people with two flipper zeroes, a pair of binoculars, and a plan could steal the Model 3. Such is life.

 

[drtimhill]

A relay attack is probably not that difficult... a pair of flipper zeroes for $170 each is probably enough to carry this out. If someone is determined enough to do this, they'll probably just follow you for a bit and watch you type your PIN to drive as well (with, for example, binoculars). I'd say it takes two people to pull off... one at the car and the other close enough to the driver. Trying to plan the second device on the driver is how you get caught.

Pickpocketing someone's key is another option for people into stealing cars. So is the "Kia Challenge", which I believe is pretty easy to pull off and definitely less expensive than two flipper zeroes. Of course, neither of those methods gets you a Tesla.

I use PIN to drive, and I also lock my bike up. People with bolt cutters can still steal the bike, and two people with two flipper zeroes, a pair of binoculars, and a plan could steal the Model 3. Such is life.

Agreed the trick is to make it hard enough they will look elsewhere for easier pickings. Sad but true.

 

[RayK]

Video from a year and a half ago. I suspect that this guy opened up my wife's 2018 Ridgeline using a relay attack. He passed up my neighbor's Model Y (the headlight flash at the start of the clip). He did try my other neighbor's Pathfinder, directly across the street as he paused by the driver's door for a few seconds before walking to my house. At 32 seconds into the video, he's grabbing the Ridgeline driver's door with his left hand but waiting while doing something else in his right. A few seconds later the interior light goes on and then he opens the door. He was inside for several minutes (the video is two clips stitched together; watch the time in the upper right). We missed him by seconds as I have a driveway monitor that triggers an alarm when someone approaches the vehicles. I was in the bathroom at the time and I reviewed recordings before realizing what was happening otherwise I would have been out there sooner.

We are sure that my wife's truck was locked. We used to keep our keychains hanging up on a board near the front door. No more. Now they're inside faraday boxes. I have a non-passive fob that I take with me whenever I go out as it also has my house keys on the chain. I try to disable my phone's bluetooth each night but sometimes I forget. I guess that means I should enable PIN to drive to be safe(r).

 

[GlazedHam]

Honestly what kind of theif would specifically target teslas? Sure you might be able to preform a relay attack and drive away but then what? You are in a car that reports it's GPS location back to the mothership.

 

[ucmndd]

Honestly what kind of theif would specifically target teslas?

People who know exactly what they’re looking for.

Sure you might be able to preform a relay attack and drive away but then what? You are in a car that reports its GPS location back to the mothership.

It’s easy enough to disable connectivity and keep the car from phoning home.

My daughter’s iPhone was stolen about a year ago. We did everything right - had Find My turned on, marked the device as stolen within 30 minutes of it being snatched - in theory making it a useless brick to a thief.

We were able to track its location for days - police didn’t care. Clearly weren’t going to go hunting it down. In less than a week it was in Vietnam, where it pinged its last ping shortly before I’m sure it was broken down into parts for resale.

Similar story for organized crime rings stealing cars.

 

[ucmndd]

Really Bad neighborhood? Work in a Ghetto? Play in low life locations? Why the paranoia? Park in the garage and Forget about it.

Might be a shocker, but not everyone lives in a place with a garage to hold their cars.

 

[GlazedHam]

People who know exactly what they’re looking for.


It’s easy enough to disable connectivity and keep the car from phoning home.

My daughter’s iPhone was stolen about a year ago. We did everything right - had Find My turned on, marked the device as stolen within 30 minutes of it being snatched - in theory making it a useless brick to a thief.

We were able to track its location for days - police didn’t care. Clearly weren’t going to go hunting it down. In less than a week it was in Vietnam, where it pinged its last ping shortly before I’m sure it was broken down into parts for resale.

Similar story for organized crime rings stealing cars.

A stolen iPhone is a little bit different from a stolen car. Phone theft gangs wrap the phone in aluminum foil to create a makeshift faraday cage and prevent the phone from receiving signals. Where tesla puts the LTE antenna would be pretty difficult to wrap in foil.

 

[terranx]

A stolen iPhone is a little bit different from a stolen car. Phone theft gangs wrap the phone in aluminum foil to create a makeshift faraday cage and prevent the phone from receiving signals. Where tesla puts the LTE antenna would be pretty difficult to wrap in foil.

It’s easy to unplug though

 

[ucmndd]

A stolen iPhone is a little bit different from a stolen car. Phone theft gangs wrap the phone in aluminum foil to create a makeshift faraday cage and prevent the phone from receiving signals.

No, in my experience they don’t even bother. That’s the point.

Where tesla puts the LTE antenna would be pretty difficult to wrap in foil.

I seriouslt doubt it’s hard or time consuming to disconnect.

 

[nurusz]

You can use an Android phone as an NFC key. Not iPhone. Bit of an important detail.

This is a good reason to throw away the iPhone