Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

esat.kuleuven.be

Post reply on HN
Print view View original

11–20 of 35 posts

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#11

Post by walrus01 »

dchichkov wrote: post #10
walrus01 wrote: post #9

Earlier quoted context omitted.

I don't disagree with the premise of that cartoon, but it's more about the concept of putting full disk encryption on your laptop, crossing the border into Uzbekistan, and then refusing to give up the password. By that logic, anything that is protected by crypto, if you threaten the owner with violence, it can be stolen from them. Which is just about everything on earth, if you're willing to apply sufficient violence…

I was referring mostly to the concept of "A crypto nerd's imagination". Seriously, it is unlikely someone would put the money and R&D effort required to replicate the researcher's solution with the goal of stealing these camera systems on the wheels that can be disabled remotely. So I'd rather advocate for Tesla to continue using inexpensive and secure enough solution to unlock doors. And focus their efforts on makin…

I can totally see people stealing Teslas, if you bring $100 worth of jamming equipment with you, it won't be disabled remotely. The cellular frequencies that a Tesla uses for M2M connections back to the mothership are not rocket science to jam.

At least not before it's driven into a warehouse somewhere and cut apart to be cannibalized for repair parts, then parts shipped overseas.

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#12

Post by dchichkov »

walrus01 wrote: post #11
dchichkov wrote: post #10

Earlier quoted context omitted.

I was referring mostly to the concept of "A crypto nerd's imagination". Seriously, it is unlikely someone would put the money and R&D effort required to replicate the researcher's solution with the goal of stealing these camera systems on the wheels that can be disabled remotely. So I'd rather advocate for Tesla to continue using inexpensive and secure enough solution to unlock doors. And focus their efforts on makin…

I can totally see people stealing Teslas, if you bring $100 worth of jamming equipment with you, it won't be disabled remotely. The cellular frequencies that a Tesla uses for M2M connections back to the mothership are not rocket science to jam. At least not before it's driven into a warehouse somewhere and cut apart to be cannibalized for repair parts, then parts shipped overseas.

Repair parts for what? Who will purchase these?

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#13

Post by tropo »

walrus01 wrote: post #2

Oh dear. Seriously, 24-bit and 40-bit crypto of any variety? Was it really so hard in the year 2013 to put at least a 128-bit AES key in the card? With a sufficient directional panel antenna you could impersonate a car and query pocketed fobs in whole crowds of somewhat wealthy individuals. Aim the antenna and rig at the seating area of a trade show for middle/upper management types in the technology industry, for in…

The obvious choice is to sort of skip the crypto entirely. The key fob can hold more than enough 128-bit random numbers to last the life of the car. Think about how much we can put on a little USB device these days. Cross off codes as they are used. This only requires a 1-way signal and a transmit button.

If the car can just ask for a code, without a button being pressed, then you have the problem of a foe tunneling the keyfob signal over a long-distance repeater link. Dealing with that requires timing measurements to measure the distance that the signal has traveled.

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#15

Post by FullyFunctional »

tropo wrote: post #13
walrus01 wrote: post #2

Oh dear. Seriously, 24-bit and 40-bit crypto of any variety? Was it really so hard in the year 2013 to put at least a 128-bit AES key in the card? With a sufficient directional panel antenna you could impersonate a car and query pocketed fobs in whole crowds of somewhat wealthy individuals. Aim the antenna and rig at the seating area of a trade show for middle/upper management types in the technology industry, for in…

The obvious choice is to sort of skip the crypto entirely. The key fob can hold more than enough 128-bit random numbers to last the life of the car. Think about how much we can put on a little USB device these days. Cross off codes as they are used. This only requires a 1-way signal and a transmit button. If the car can just ask for a code, without a button being pressed, then you have the problem of a foe tunneling…

Exactly (the last part). There's a fundamental weakness here. Fixing the obvious weakness in the single sided authentication and weak crypto isn't enough to fundamentally solve it. Not sure there's _any_ way to fully make this secure. AFAIK, Model 3 doesn't have this feature & vulnerability.

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#17

Post by ttflee »

FullyFunctional wrote: post #16
Rebelgecko wrote: post #3

There's no excuse in 2018 for using a 40-bit key. Hopefully Tesla gives its customers the upgraded fobs for free.

No amount of perfect encryption will protect against a relay attack.

You should use a key exchange protocol like Diffie Hellman

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#18

Post by FullyFunctional »

ttflee wrote: post #17
FullyFunctional wrote: post #16

Earlier quoted context omitted.

No amount of perfect encryption will protect against a relay attack.

You should use a key exchange protocol like Diffie Hellman

Doesn't help one iota. The relay attack uses a two way amplifier to effectively increase the reach of the frob. This way the evildoers can steal the car while you are sleeping.

As tropo suggests above, it would have to measure the distance (signal propagation), but I suspect that would drive the cost of the frob up significantly.

EDIT: to be clear, this isn't the attack discussed in the article, but a more serious problem that is already in use today.

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#19

Post by Rebelgecko »

FullyFunctional wrote: post #16
Rebelgecko wrote: post #3

There's no excuse in 2018 for using a 40-bit key. Hopefully Tesla gives its customers the upgraded fobs for free.

No amount of perfect encryption will protect against a relay attack.

This is even worse than a relay attack, since AFAIK those require being near the fob and there are other mitigations (even simple things like timing how long it takes to get a response). This attack essentially lets you clone key fobs permanently, not just start a car while the owner is on the other side of a parking lot. And the encryption would work a heckuva lot better if the attacker had to precalculate every challenge and response with, for example 256 bit AES keys instead of 40 bit keys with 24 bit responses.

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#20

Post by ttflee »

FullyFunctional wrote: post #18
ttflee wrote: post #17

Earlier quoted context omitted.

You should use a key exchange protocol like Diffie Hellman

Doesn't help one iota. The relay attack uses a two way amplifier to effectively increase the reach of the frob. This way the evildoers can steal the car while you are sleeping. As tropo suggests above, it would have to measure the distance (signal propagation), but I suspect that would drive the cost of the frob up significantly. EDIT: to be clear, this isn't the attack discussed in the article, but a more serious pr…

Sorry, I mistook your point.

The critical issue for rf keys is the lack of a button to lock/unlock the door.

Post reply on HN