Researchers find serious flaws in Model X keyless entry system
The same group of researchers has previously hacked the Tesla Model S keyless entry system. The researchers have now and shown how the security measures of the more recent Tesla Model X can be bypassed. The Tesla Model X priced at over $100.000 US can be stolen in only a few minutes.
Tesla has used an over-the-air software update to mitigate these issues found by the researchers.
The key fob of the Tesla Model X allows the owner to automatically unlock the vehicle by either approaching it, or pressing a button. Bluetooth Low Energy (BLE) is being used more in “phone-as-key” solutions to allow a smartphone APP to unlock the car. The Tesla Model X key fob uses BLE to communicate with the vehicle.
“Using a modified Electronic Control Unit (ECU), obtained from a salvage Tesla Model X, we were able to wirelessly (up to 5m distance) force key fobs to advertise themselves as connectable BLE devices. By reverse engineering the Tesla Model X key fob we discovered that the BLE interface allows for remote updates of the software running on the BLE chip. As this update mechanism was not properly secured, we were able to wirelessly compromise a key fob and take full control over it.
Subsequently we could obtain valid unlock messages to unlock the car later on”, says Lennert Wouters, PhD student at the COSIC research group.
“With the ability to unlock the car we could then connect to the diagnostic interface normally used by service technicians. Because of a vulnerability in the implementation of the pairing protocol we can pair a modified key fob to the car, providing us with permanent access and the ability to drive off with the car”, Wouters adds.
Two weaknesses exposed
“To summarize, we can steal a Tesla Model X vehicle by first approaching a victim key fob within about 5 meters to wake up the key fob. Afterwards we can send our own software to the key fob in order to gain full control over it. This process takes 1.5 minutes but can be easily performed over a range of more than 30 meters. After compromising the key fob, we can obtain valid commands that will allow unlocking the target vehicle. After approaching the vehicle and unlocking it we can access the diagnostic connector inside the vehicle. By connecting to the diagnostic connector, we can pair a modified key fob to the car. The newly paired key fob allows us to then start the car and drive off. By exploiting these two weaknesses in the Tesla Model X keyless entry system we are thus able to steal the car in a few minutes”, says Dr. Benedikt Gierlichs, researcher at COSIC.
The attack used a self-made device that was built from a Raspberry Pi computer ($35) with a CAN shield ($30), a modified key fob and ECU from a salvage vehicle ($100 on eBay) and a LiPo battery ($30).
The researchers informed Tesla of the issues on 17th August 2020. Tesla confirmed the vulnerabilities, awarded the researchers a bug bounty and started working on security updates. As part of the 2020.48 over-the-air software update, that is now being rolled out, a firmware update will be pushed to the key fob.
More information
Related news
Pentek enhances Navigator Design Suite
Digital I/O capability added to ATR recorder family
imec and CEA-Leti work together on AI and quantum computing
ASML and IMEC collaborate to take EUV lithography to high-NA
If you enjoyed this article, you will like the following ones: don't miss them by subscribing to :
