Hacker News Reader

Comment by jasoncartwright | Hacker News Reader

This has happened so many times (I've heard of at least 5) in the UK to Tesla cars that Tesla themselves sent out a warning with instructions on how to turn off the passive entry feature that allows this attack.

https://pasteboard.co/HypzOWg.png

Here's a video of a relay theft (of a Merc) from West Midlands police in the UK...

https://www.west-midlands.police.uk/news/4544/watch-police-r...

Photo from a camera of attempted theft, from a UK Tesla owner...

https://pasteboard.co/HypF8Ep.jpg

View on HN

Maybe you could stop this attack by having an IMU in the key so it only broadcasts the unlock signal while it's being held/moved.

Many suggestions for foiling this (including some interesting Tesla specific ones, like having the screen ask for a PIN), but the simplest is to just have the key not unlock the car unless a button is pressed.

Not a massive inconvenience.

Sure. Was just trying to solve the problem while keeping the same experience, which some automotive manufacturers must think is worth providing to customers.

If you had a receiver with a nanosecond precision you can measure the distance to the key with enough accuracy that the relay attack doesn't work anymore. I don't know why manufacturers don't do that yet - I guess the parts necessary are still not available at scale yet?

I personally just keep the keys in a metallic bag at night, blocks all signals perfectly.

It's coming in the next generation of keyless systems: https://www.3db-access.com/

I’m curious, why not just proper cryptographic challenge-response?

Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car unlocks, otherwise not and the user can try again.

Seems like à solved problem really.

Why not relay that, too?

Relaying would still require the owner to push a button on the keyfob, right?

No. The point of this whole thread is there is no button so that when you approach the car it unlocks automatically. That's why this attack is possible by extending the range with repeaters. The key likely already has something similar to what you suggested but that can't prevent this attack.

The entire point, rightly or wrongly, of keyless entry is that you never have to touch the key, simply have it somewhere in the vicinity of the car, such as in your pocket. No button pressing or user input. You approach the car and it is already magically unlocked and ready to be started, usually via a starter button on the dash.

Therefore the same concerns regarding relaying still apply, unless I’ve misunderstood your reply, but your later post suggests pressing a button on a key. If buttons on the key are pressed, this ceases to be “keyless” as the car industry understands it - this is back to conventional remote locking.

This is precisely how it works already, exactly as you described. The issue is that the relay just boosts the signal,so the car thinks your key is nearby, while in reality it's in your bedside drawer.

I have built an access control system that does a similar thing. Long story short: Time Of Flight is patented and no one can use it. Our system used a nice workaround... We tried to convince car manufacturers to use or license our tech and they seemed happy with their current stuff.

How can one patent something so obvious as measuring how far away something is based on how long the signal takes to bounce back? That principle underlies...so many things.

Edit: I looked up the patent. Here it is: https://patents.google.com/patent/US8930045. I understand that patents protect novel inventions and that under some standard this may be considered "novel". On the other hand, I myself have frequently used the technique of sending a signal, awaiting a response, and then using timing to derive the distance. It seems such an obvious application to this use case that there is nothing novel here.

Hmmm. 2013? I beat them by a year.

http://rachelbythebay.com/w/2012/02/07/ping/

A few years before 2002:

https://www.ibiblio.org/harris/500milemail.html

You just have to convince the patent examiner that it's not obvious. There's bound to be prior art (radar), so it could probably be invalidated if you want to spend the money on it, and you don't have some alternative ready to hand.

Is that how contactless payment cards are protected?

No, contactless cards could be hacked in the exact same way cars are, but it's not worth the trouble since you would need an authorized terminal and the most you could steal is £30 - it's just not worth the trouble.

Steal £30 off enough people, though - RFID/NFC has been demonstrated to have a range of several meters under some conditions, so just stick your equipment in a bag and wander through a shopping centre. Probably pickup a dozen or so. I understand those who buy RF-shielded wallets all too well.

But like I said, only an authorized terminal will process transactions, so you need to figure out how to get one. And then, visa and MasterCard take at least a week to pay out any money from card transactions - so your terminal and likely the entire account will get banned before you get a penny out of that money.

It's not that £30 is little money - it's that it's nearly impossible to secure a working terminal and then once you have that actually get any money out of it.

Like the parent comment said, you need an authorized terminal, which is linked to a merchant account, which is linked to your bank account (and thus your identity). What do you think visa/mastercard is going to do when the fraud reports start flooding in? Chances are, you're going to be caught before your first payment arrives in your bank account.

If you get a pin number then it’s different. AFAIK there are contactless ATM’s.

Contactless ATMs still require a pin - one of the defining features of contactless is that you can't get cash with it. If you ask for cashback at the till and use contactless then you also need to enter the pin.

Well, for some people, pulling the parking brake is a "massive inconvenience" which ends up having serious consequences.

Technology can't solve everything.

The attacker could just wait outside your house for you to hold or move it as you head off to work in the morning then come back at night to pick the car up

It doesn't work like that. This can't be recorded and replayed later. This attack works by extending the range of the exchange between car and key in real time using handheld repeaters.

The entire idea of passive keyless entry is that you just have the keyfob in your pocket, and can enter the car as you approach it without touching your keyfob.

That also means that relay attack is always going to work. So either accept the risk or disable the feature.

Reply on news.ycombinator.com