Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Time to start using your PIN to drive...

So someone needs to have 2 devices, one within 7meters of my phone and the other a few meters from my car?

There is almost no time this can happen that I'm not actually standing near the car. Not at work, not at home, not parked out in the world.

I could see this maybe working in a really busy street with dozens of people around? But then you'd see someone loitering by your car as you lock it?

Or maybe someone in a car next to you when you park in a lot could pull this off?
 
So someone needs to have 2 devices, one within 7meters of my phone and the other a few meters from my car?

There is almost no time this can happen that I'm not actually standing near the car. Not at work, not at home, not parked out in the world.

I could see this maybe working in a really busy street with dozens of people around? But then you'd see someone loitering by your car as you lock it?

Or maybe someone in a car next to you when you park in a lot could pull this off?
There are many places a person could put a device on the outside of my house that would be within 7m of my phone.
Not really worried about this though...
 
So someone needs to have 2 devices, one within 7meters of my phone and the other a few meters from my car?

There is almost no time this can happen that I'm not actually standing near the car. Not at work, not at home, not parked out in the world.

I could see this maybe working in a really busy street with dozens of people around? But then you'd see someone loitering by your car as you lock it?

Or maybe someone in a car next to you when you park in a lot could pull this off?
I think that's exactly what would happen.

You get out of your car, and someone in the car park is hanging around waiting for a Tesla - it's a busy park so no one really pays attention to the guy. You get out of your car and start walking towards the shop and the guy just walks up to your car and gets in and drives away.
 
  • Like
Reactions: Prairie
Or just not worry about it and have good insurance.
security.png


If someone wants your car, they will get it one way or another.
 

drtimhill

Active Member
Apr 25, 2019
3,404
4,406
Seattle
BLE is vulnerable to relay hacks, so it's time to start locking our cars with PINs.

BLE Relay Hack
This is a relay attack, so while interesting the real-world risk is low. Basically the attacker has to have equipment close to the car AND close to your phone at the same time (within about 20 feet of each). They can't just walk up to any Tesla anywhere and unlock it. They MIGHT just be able to pull it off if you were at home with the car parked in the garage, but then they would also have to break into the garage, WHILE you were at home (with your phone).
 
This is a relay attack, so while interesting the real-world risk is low. Basically the attacker has to have equipment close to the car AND close to your phone at the same time (within about 20 feet of each). They can't just walk up to any Tesla anywhere and unlock it. They MIGHT just be able to pull it off if you were at home with the car parked in the garage, but then they would also have to break into the garage, WHILE you were at home (with your phone).
Garage door openers are also vulnerable to relay attacks.
 
  • Like
Reactions: Phlier
So someone needs to have 2 devices, one within 7meters of my phone and the other a few meters from my car?

There is almost no time this can happen that I'm not actually standing near the car. Not at work, not at home, not parked out in the world.

I could see this maybe working in a really busy street with dozens of people around? But then you'd see someone loitering by your car as you lock it?

Or maybe someone in a car next to you when you park in a lot could pull this off?
Easy scenario. Two person team at a grocery parking lot with EV chargers. You plug in to charge while you shop. One person follows you into the store with one device in a backpack. The other with the corresponding device just walks up to your Tesla, unplugs, and drives away.

PIN to drive…
 
  • Like
Reactions: t3sl4drvr

drtimhill

Active Member
Apr 25, 2019
3,404
4,406
Seattle
Easy scenario. Two person team at a grocery parking lot with EV chargers. You plug in to charge while you shop. One person follows you into the store with one device in a backpack. The other with the corresponding device just walks up to your Tesla, unplugs, and drives away.

PIN to drive…
.. and as soon as the car is parked and locked, the thieves cannot get into it and the owner and the police know where the car is. I don’t think they will last long. Not saying this isnt a nasty attack, but its practical use to thieves seems limited. I suspect its main use will be to steal items from the car, not the car itself.
 
  • Like
Reactions: Sigma4Life
So someone needs to have 2 devices, one within 7meters of my phone and the other a few meters from my car?

There is almost no time this can happen that I'm not actually standing near the car. Not at work, not at home, not parked out in the world.

I could see this maybe working in a really busy street with dozens of people around? But then you'd see someone loitering by your car as you lock it?

Or maybe someone in a car next to you when you park in a lot could pull this off?

Yeah, I think this hack would work best in dense urban areas, with cars parked outside near apartments or some such scenario. If you wanna steal my Tesla it would be far easier to arrange to mug the valet at my favorite beach resort than to try and get the required geometry of being near my phone and car at the same time without my knowing about it.
 

Twiglett

Single pedal driver
Oct 3, 2014
3,811
4,359
Austin
they could also show up with a flatbed and pull the car up on to it.
they could also disable LTE or shield it
they could wait for the unmanned valet stand to grab the keys/key cards etc etc etc
they could do a whole bunch of things...
The reality is that they probably won't - whereas I would be using pin to drive every. stinkin. time. I. drive. the. car.
I'd rather use the keycard
or not worry about it :D
 

CyberGus

Not Just a Member
May 5, 2020
1,553
3,539
Austin, TX
I saw a YouTube (WhamBamTeslacam?) showing professional thieves using the relay method to steal Teslas parked outside a home. When done in the night, they have plenty of time to drive it elsewhere and disable tracking (pull the SIM card I believe).

So yeah I would use a PIN if the car cannot be secured at night. Just don't use "0000" lol
 
  • Funny
Reactions: Twiglett

Yelobird

Active Member
Aug 24, 2020
1,196
1,608
Illinois
I saw a YouTube (WhamBamTeslacam?) showing professional thieves using the relay method to steal Teslas parked outside a home. When done in the night, they have plenty of time to drive it elsewhere and disable tracking (pull the SIM card I believe).

So yeah I would use a PIN if the car cannot be secured at night. Just don't use "0000" lol
That’s crazy talk. The secret password is 1234. Duh
 
Appreciate the responses describing what a relay attack is. I read an article on arstechnica about this and didn't leave with much understanding. You all did better. Makes me feel a bit better as well. Worst they can do is get in your car with Pin to drive I suppose. Only thing bothering me there is vandalism like knifing the seats / breaking display / etc and my 380 auto I keep in it
 
Last edited:

Lloyd

Well-Known Member
Supporting Member
Jan 12, 2011
6,405
2,339
San Luis Obispo, CA
they could also show up with a flatbed and pull the car up on to it.
they could also disable LTE or shield it
they could wait for the unmanned valet stand to grab the keys/key cards etc etc etc
they could do a whole bunch of things...
The reality is that they probably won't - whereas I would be using pin to drive every. stinkin. time. I. drive. the. car.
I'd rather use the keycard
or not worry about it :D

I used to install car alarms when I was in college. This guy with a turbo porsche had me install the best I could find. Three months later his car got stolen. The thieves drilled into the battery and drained it so it wouldnt sound or report lojack. Then they put the car on a flatbed and towed it off. If they want your car they will get it.
 

CyberGus

Not Just a Member
May 5, 2020
1,553
3,539
Austin, TX
I used to install car alarms when I was in college. This guy with a turbo porsche had me install the best I could find. Three months later his car got stolen. The thieves drilled into the battery and drained it so it wouldnt sound or report lojack. Then they put the car on a flatbed and towed it off. If they want your car they will get it.

Really looking forward to reading about the thieves that tried to drill into a Tesla pack...
 

Lloyd

Well-Known Member
Supporting Member
Jan 12, 2011
6,405
2,339
San Luis Obispo, CA
From the Rivian Blog:....


This isn't how the BLE or NFC system works. Has anyone had their R1T lifted by a crook using this method? I don;t think so.
Did you read the paper linked in the article? The whole point of the attack is that it is based exactly on how BLE works. The NFC cards are something different, and the fob may also be some other sort of radio, too. Phone-as-key could be vulnerable to this sort of attack, but for the reasons outlined in the paper it would still take a pretty concerted effort to pull off.

R1T owners who have enabled phone-as-key have complained about how the car locks and unlocks when they are walking around their house. I could see Rivian releasing a feature that disables or "quiets" phone-as-key when the car is parked at a known location like home or office. Doing so would also mitigate the attack described in this paper.

As far as Tesla goes their BT key fobs were VERY vulnerable because they had made a cascading series of poor decisions regarding security that made it very easy to steal (at least in theory, who knows how many were actually stolen that way). Given the publicity around the Tesla vulnerabilities, I would expect that Rivian learned those lessons and that their implementation is more secure at this point.


SaveShare
Reply Quote
Like
 

About Us

Formed in 2006, Tesla Motors Club (TMC) was the first independent online Tesla community. Today it remains the largest and most dynamic community of Tesla enthusiasts. Learn more.

Do you value your experience at TMC? Consider becoming a Supporting Member of Tesla Motors Club. As a thank you for your contribution, you'll get nearly no ads in the Community and Groups sections. Additional perks are available depending on the level of contribution. Please visit the Account Upgrades page for more details.


SUPPORT TMC
Top