Researchers Find Tesla Keyless Entry Vulnerable to Spoofing Attacks

Last week's Tesla security update may have been more urgent than the company's security update. Researchers at KU Leuven found a way to falsify Tesla's key ring system, Cable. The result would let an attacker steal a Tesla simply by walking past the owner and cloning his key.

The attack is particularly important because Tesla was the pioneer of the keyless entry concept, which has since spread in most luxury cars. This attack appears to have only worked on the Model S units delivered before June, and in an update last week, Tesla released an update that strengthened the encryption of the remaining vehicles. More importantly, the company has added the option of requiring a PIN password before starting the car, adding two factors to your car. At the time, this seemed excessive – but knowing that this type of attack is possible, it's probably worth it to leave. Tesla owners can add the PIN code by disabling passive entry in the "Doors and Locks" section of "Settings".

The attack itself is quite involved. Due to the back-and-forth protocol, attackers must first detect the car's radio ID (broadcast from the car at all times), then pass that ID to the keychain of the car. victim and listen to the answer, usually from the inside three feet of the fob. If they can do it twice in a row, the research team discovered that they could go back to the secret key feeding the keychain's answers, allowing them to unlock the car and start the engine.

It should be noted that Tesla cars are already quite resistant to theft, as GPS tracking always active often allows victims to track and recover their cars after their flight, which incites thieves to look elsewhere. However, entering a PIN code for your car is a small price to pay, especially now that public research shows how to go beyond the less sophisticated versions of the protocol.

This is not the first time such an attack has caused panic in the world of car safety. For years, Volkswagen had to deal with a flaw in the Megamos transponder, which allowed hackers to mimic a key ring and drive with cars that would otherwise have been immobilized. More generally, replay attacks are often used to unlock cars, although it is more difficult to turn them on and off.

The best defense we have against these attacks is essentially what Tesla has put in place now: a complex handshake with robust encryption to prevent decryption of signals. But the strength of this encryption is limited by the keychain itself, which can only contain the power of the processor. As researchers understand, these hacks will be difficult to avoid, making less conventional solutions such as second-factor PINs or RF-blocking key wallets all the more appealing.