Hacker News Reader

Comment by gernb | Hacker News Reader

I guess if you had a partner, someone could be in the parking lot looking for teslas being parked, then a partner could tail that person and relay over cellular to the first standing near the car?

I'm wondering what the point of this attack is. Any thief who wants in my car will just bust the windows. If they do the relay attack they can steal the car but the car has GPS and can be locked down remotely so it seems like a high risk low reward crime?

View on HN

A thief can use this method in front of cops in broad daylight. Break a window, not so much.

Recent videos would have me believe you can get away with both in broad daylight.

Come to San Francisco and you will witness the art of window breaking.

The thieves would presumably steal it from someone's home and then load it onto a truck and steal the parts.

Moving the car to a desert place and stripping it for parts would be a classic move.

GPS works in the desert.

There's probably a single fuse you can pull out, or a single wire you can cut which would disable enough of the system that you could still drive, but it would stop reporting telemetry.

You mean like... the cellular antenna?

Of course, but I was just speaking generally, I'm not sure how teslas are laid out and the accessibility of any given component.

Let's say that with enough effort you can probably reach it. But if to do that, you have to disassemble half of the car, then it's possibly not convenient to do so :D

https://www.auto-manual.com/tesla/tesla-model-3/

The wiring diagram you've linked and a few well aimed drill bits should do the trick.

Otherwise a big enough faraday cage works too. It's just not that convenient :)

I wonder how well this would work. Wouldn't the Faraday cage need to be tuned to the wavelength of the cellular radio?

Someone elsewhere suggested putting the car in a cargo container, but I don't think that works either. I was on a large ferry recently, my phone worked below deck several inclusive distance units away from the coast.

Cell modems are pretty amazing. One time I wanted to simulate losing reception on one, so I removed the antenna. It still worked, so I added a 50 ohm termination. It still worked. I finally got it to disconnect by putting it all inside an anti-static bag.

Are they? I remember disconneting the antennas of some of my devices for repair purposes and getting no reception at all (not even for emergency calls).

Maybe things changed in the last few years

Many radios have more margin on the signal once "connected". I vaguely recall that cell modems in particular need to do an initial registration with the network. That registration is probably at a fairly ancient modulation, without the benefit of the cell tower knowing where the modem is to beam form to it. It seems like that could account for 10's of dB of difference.

There is a waterproof "fuse box" in every car, similar in function to breaker box in a house, on front firewall(even for rear-engined cars!). "Pull a fuse" means removing a fuse for offending subsystem(ECU) to simply disable it, such as ABS, as clean as `apt uninstall sl` would go. What the guy above you is saying is you should be able to turn off "security feature" altogether and the car should revert to an insecure car.

But considering that Teslas are infamous for authenticating every start/stop of individual cars between the key and the infotainment computer and a datacenter in California...

I can't tell if your last sentence is sarcastic? But a Tesla doesn't call home to authenticate the kefob. Otherwise you'd never able to start the car outside of cellular reception.

Sure, and the owner would also be able to get back what's left of their car.

Only within range of cell towers to transmit the info. I’m guessing Teslas don’t have built-in two-way satellite communications.

Now we know the real reason for Starlink!

But not in a faraday cage. Stick it in a shipping container and close the door…

GPS jammers are like $50 from many chinese sellers. That's why GPS/GSM trackers are not accepted by insurance companies as vehicle trackers in my places, you need to have a VHF tracker which is much harder to jam.

> seems like a high risk low reward crime?

The upvotes on social media alone will be worth it to many nowadays.

To leave something in the car without the owner noticing?

Or take something

Yeah, this attack works in theory but is so complicated to set up and execute that a random thief is always going to go for one of the easier options, like picking your pocket or smashing a window.

On the other hand if you are a high value target and some person/organization/government has the incentive to target you in this way, you better have adequate protection.

Like that xkcd about full disk encryption and hammers

https://xkcd.com/538/

>Yeah, this attack works in theory but is so complicated to set up and execute

There are quite a few security camera videos on youtube of people stealing cars parked in driveways by what appears to be a relay attack.

Came here to say this.

On those video it looked extremely "easy" to me

> that a random thief is always going to go for one of the easier options, like picking your pocket or smashing a window.

Car thief != pick pocket thief

>> the incentive to target you in this way, you better have adequate protection.

Having owned some fancy cars, the advice you usally hear from other owners is this - the best protection you can have is a good insurance policy. Putting any kind of lock out/pin/hidden switch system on it, hiding your keys in radio-proof bags etc, is the best recipe to get hurt. Exactly because if you drive such a fancy car, the people coming to steal it are not opportunistic thieves - they are coming to get your car, and they will hurt you to get it. That's why you don't install any extra fancy "trap" systems in the car and you hang your keys right next to the front door, in plain view. If they want to take the car, don't give them a reason to come in and threaten you or your family for the keys or a lock out pin because you thought you were clever with a fancy alarm system. A Lamborghini is replacable. Your life(or the life of your children) is not.

https://xkcd.com/538/

I still remember a video from a break in our country where the thieves where pounding the door with an axe for minutes to enter, then threatened the homeowner to open the safe they knew was in the house. His wife and kids where “safe” in the attic. If they know what they want they will get it one way or another.

Imagine if we had level 5 self driving and I could from my phone lock the doors on the Lamborghini and drive it straight to the police station

Few problems with that:

1) luxury cars that are stolen "on order" are usually placed on a trailer/container straight away and not driven around.

2) you assume you can still talk to the car after it's taken - sadly, GSM/GPS jammers are very cheap and common amongst car thieves.

3) even if you have L5 autonomy, I would be really surprised if you could override what the car is doing while it's being driven. Sounds like a recipe for disaster. I'm not sure anyone should even have the ability to do something as simple as shut it down remotely - there's far too much risk of abuse.

Has anyone tried to disable the GPS and cellular connection on the models affected?

This dawned on me the other day, if someone hopped in my Tesla and drove away I’m not sure I could do anything in the app to hinder them. Maybe set valet mode? Best I could do there is cap it to 50

Turns out your car is, in fact, a car.

The way the app works though with the default setup leaves it unlocked/ready to go until you walk a considerable distance away. I could see thieves eventually figuring that out.

You can add a PIN as a second factor. See PIN to drive in the manual

https://www.tesla.com/ownersmanual/modely/en_us/GUID-94B0E05...

> If the touchscreen is still unresponsive, you can still bypass PIN to Drive by turning on Keyless Driving in the Tesla mobile app.

Isn't this what the research team is abusing? If so, make sure that's turned off too!

Huh. I guess you are right… odd

Pretty sure turning on Keyless driving is separate from unlocking/starting the car with Bluetooth. To do it requires the Tesla account password and I believe is relayed via the LTE connection of the car.

The cops would be able to follow them via GPS, though.

Reply on news.ycombinator.com