Live data from Hacker News

Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

esat.kuleuven.be

31–35 of 35 posts

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#31
post #23

Earlier quoted context omitted.

Proposal for expensive cars that don't require a button press: The key fob and car contain identical pre-shared random data. (could be gigabytes) Each transaction uses 4 tokens, 2 going in each direction, with each token being 128 bits. Upon a button press, the key fob selects and destroys the next 1-time-use token it contains. It begins to transmit. First the key fob sends a token. The car must respond with the corr…

This is not a bad idea but I can think of two problems in real world execution: a) Car companies won't want to hand out fobs that have any sort of writable memory, takes battery, and risks write memory wearout. Never seen a fob or smartcard that has memory which is written with every individual transaction. Having the fob do a computation on every transaction means it will need a lot more battery (in Wh per year) com…

> Never seen a fob or smartcard that has memory which is written with every individual transaction.

Actually every SIM card does this. At least when used by a phone to join a mobile network, a SIM writes some timestamp or counter to persistent internal memory. This caused a funny case of SIM cards with very limited lifetime for a German provider (I think it was Congstar), who had a problem in its network that caused frequent authentications of handsets, thereby having them chew through the write cycles of their SIM cards way faster than projected for normal use. The cards became "dead" afterwards.

If I remember correctly, all chip enabled payment cards also have a transaction counter that is updated on every successful transaction.

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#32
post #27

Most keyless systems are insecure in several other ways to a surprising degree for this decade. Even in more recent years, most of them seemingly do not implement (1) Time of flight checks, e.g. that a radio relay isn't being used to get to the keyfob many more meters away in the house using a relay/amplifier. This is a commonly exploited theft method currently. The Apple watch implements this to unlock your MacBook…

> Time of flight checks, e.g. that a radio relay isn't being used to get to the keyfob many more meters away in the house using a relay/amplifier.

That one's surprising. What's to stop someone following you into a supermarket after you've parked your Porsche, standing next to you with a relay device transmitting via the cell network, and someone else in the car park with the equivalent receiver/relay?

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#33

Not just Model S: "We have only been able to verify our attack on a Tesla Model S in practice. However, Tesla did not design this system themselves but purchased it from Pektron. ... Pektron also designed keyless entry solutions for manufacturers such as McLaren, Karma and Triumph. ... This leads us to believe that the attack described here also affects the other manufacturers."

It seems odd to make that claim about other companies without actually checking. It could be true, but it also wouldn't surprise me at all if Tesla were cutting corners here in a way that McLaren doesn't for the really obvious reason that they're selling £185k cars, not £70k cars.

Re: Tesla Model S Can Be Stolen in Seconds by Cloning Its Key Fob

#35
post #23

Earlier quoted context omitted.

Proposal for expensive cars that don't require a button press: The key fob and car contain identical pre-shared random data. (could be gigabytes) Each transaction uses 4 tokens, 2 going in each direction, with each token being 128 bits. Upon a button press, the key fob selects and destroys the next 1-time-use token it contains. It begins to transmit. First the key fob sends a token. The car must respond with the corr…

This is not a bad idea but I can think of two problems in real world execution: a) Car companies won't want to hand out fobs that have any sort of writable memory, takes battery, and risks write memory wearout. Never seen a fob or smartcard that has memory which is written with every individual transaction. Having the fob do a computation on every transaction means it will need a lot more battery (in Wh per year) com…

They could use MRAM memory for the first option. Low capacity MRAM is quite practical and it has very high endurance.
Post reply on HN