You've probably seen the videos on social media and the headlines of people driving
by parked Teslas, opening up their charge port doors with a special device
and in other videos showing people opening up other people's cars with their phones!
Well, in this video I'll show you how they are able to do that
and show you how to prevent thieves from driving off in your Tesla! Hey there and
welcome my name is Daniel. Before we go into these hacks and how to prevent them
I'd like to remind everyone to please subscribe to the channel, click on thumbs up, and share the video.
First off, let's take a look at the opening of the charging port.
Now Tesla vehicles have their charging port under a cover
that opens on command from the owner, for example the owner can say, " open but-hole"
and as you can see there it actually opens up and it allows me to connect the charger
to the system. To close it, you can click on close charge port and it closes or you can
actually use the UI by simply taking your finger there and tapping on the charge port
and it'll open up that way as well or you can use the phone app or even the key fob and let us
not forget that you can always manually open up the charge port door simply by tapping on it!
Now all these ways are great but has been discovered that anyone can replay the 315
megahertz signal using a special software defined radio and pop the port open on any
tesla that is nearby now apparently opening up the charging port isn't the end of the world
since there isn't much that you can actually do with the charging port other than charging
the car this trick does not give access to the inside of the car but this next hack
is far worse many newer cars Tesla included can be accessed through the owner's phone
using Bluetooth when someone uses a phone to unlock a device or a car it uses Bluetooth
signals to measure their proximity to each other when the car and the phone are close the door can
automatically be unlocked also when the phone and the car are further apart it locks this proximity
authentication works on the assumption that the key stored on the phone can only be transmitted
when the locked device is within Bluetooth range which is approximately 30 feet or about 9 meters
now research has devised a hack that allows him to unlock millions of Teslas and countless
other devices like laptops etc. even when the authentication phone or key fob are miles away
the hack which exploits a weakness in the Bluetooth low energy standard adhered to
by thousands of device makers can be used to unlock doors open and operate vehicles
and gain unauthorized access to a host of laptops and other security sensitive devices
Sultan Qasim Khan, a principal security consultant and researcher at the security firm NCC Group
stated, "hacking into a car from hundreds of miles away tangibly demonstrates how our connected
world opens us up to threats from the other side of the country and sometimes even from
the other side of the world." He added, " this research circumvents typical countermeasures against remote
adversarial vehicle unlocking and changes the way we need to think about the security of Bluetooth
low energy communications." This class of hack is known as the relay attack it is a close cousin to
the person in the middle attack in its simplest form a relay attack requires two attackers
in the case of the locked tesla the first attacker which I'll call attacker number
one is in close proximity to the car while it's out of range of the authenticating phone
attacker number two meanwhile is in close proximity to the authenticating phone used to
unlock the vehicle attacker number 1 and attacker number 2 have an open internet connection that
allows them to exchange data here we see attacker number one use their Bluetooth enabled device to
impersonate the authenticating phone and then send the tesla a signal prompting the tesla to reply
with the authenticating request attacker number one captures this request and sends it to attacker
number two who in turn forwards the request to the authenticating phone the phone then responds with
the correct credential which attacker number two promptly captures and then relays back to
attacker number one attacker number one then sends the credential to the car once the car receives
the correct credential it unlocks the doors attacker number one now can enter the vehicle
these types of relay attacks in the real world do not need to have two actual attackers a relaying
device can be stashed near where the car is parked like a garden parking lot or in a bush
as we see here when the target car arrives at the destination and moves into the Bluetooth
range of the stash device it retrieves the secret authentication request from the car and
it relays it back to the attacker who is near the owner's phone which then receives the credential
and then sends the data back to the device unlocking the car for the attacker
the susceptibility of BLE or Bluetooth Low Energy to relay attacks is well known so device makers
have long relied on countermeasures to prevent the above scenario from actually occurring
one defense is to measure the flow of requests and responses and reject authentications when the
latency reaches a certain threshold since relayed communications generally take longer to complete
than legitimate ones another protection is encrypting the credential sent by the phone
or the fob but the research done at the security firm NCC Group has found that it is possible that
a sophisticated BLE relay attack defeats these mitigations making such hacks viable
against a large base of devices and products previously assumed to be safe from such attacks
further the NCC group BLE relay attack uses custom software and about a hundred dollars
worth of equipment they have confirmed that it works against Tesla Model 3, Model Y and Kevo smart locks s
locks such as the Kwikset and Wiser Bluetooth locks but they added that virtually any BLE
device that authenticates solely on proximity as opposed to also requiring user interaction
geolocation confirmation or something else is vulnerable there are ways to prevent this hack
one way is to check the location of the authenticating device
to ensure that it is in fact physically close to the locked car or other device
another counter measure is to require the user to provide some form of input of the authenticating
device before it's trusted so what can you do to prevent your car from being stolen using this
method first simply activate pin to drive feature which is available as an option in the car and
requires drivers to enter a custom pin to start the vehicle it adds an extra layer of security
that ensures that only an authorized person who knows the correct pin can drive the car and not
thieves who have managed to gain access to your vehicle illicitly let me show you how to do it
all right now to enable that pin to drive that extra layer of security click on the car once
you've tapped on the car you'll see the controls come up here i want to scroll all the way down
to where I see safety and then scroll down again to where it says pin to drive click that on now
we can create a new pin to drive I'll choose one here 23 23 there we go now what happens is before
the car allows you to put it into drive you have to put in the code so let me pull on the brake and
it asks for the code so we'll put that in there we go now you see that I can change it and put it
into drive or into this case reverse next owners who still want the convenience of passive entry
should buy a good quality faraday bag to store the key fob or phone in when it's not being used
these are cheap pouches that block signals to and from the key fob inside
thereby preventing the would be test the thieves from intercepting communications
and finally always use sentry mode which records all movements around the car
so now you know how to prevent would-be tesla thieves from stealing your tesla .
Hey if you like these types of videos please give it a thumbs up
comment down below because I love reading your comments and I wish to say a special
thank you to all those who have been sharing my videos but we'll see you next time and bye bye!