Teslas Can Still Be Stolen with a Cheap Radio Hack–Despite New Keyless Tech | Hacker News Reader

Teslas Can Still Be Stolen with a Cheap Radio Hack–Despite New Keyless Tech

wired.com

37 pointssrameshc24 comments

> Since the Tesla 3's keyless entry system also controls the car's immobilizer feature designed to prevent its theft, that means a radio hacker could start the car and drive it away in seconds—unless the driver has enabled Tesla's optional, off-by-default PIN-to-drive feature that requires the owner to enter a four-digit code before starting the car.

I've always thought that keyless starts are a tiny UX improvement over just inserting a key and twisting it, and an improvement that is totally not worth all of the additional security complications. Now I learn that to patch the security complications it's now recommended that you set a four-digit pin that you have to type in in order to start the car. That will take at least as long as twisting the key does in a traditional car.

So, a question for people who have keyless starts: If the time savings are used up by a PIN, do you still derive any value from keyless starts?

I get value from not having to carry keys. That's less bulk for me. I carry no keys at this point I my life, and it's great.

Locks are a societal agreement, not an impenetrable shield. My car is not a fortress or a safe. It's covered in glass. Having a mechanical switch inside a glass box is no more secure if your threat model is "someone technically advanced and highly motivated".

I'm not so concerned about keyless entry, it's keyless starts that I'm worried about. We've come a long way in preventing hot wiring, and this feels like a step back.

I was under the impression that you do in fact need to carry a key in order to start the car, it's just a key fob instead of a key. Is that inaccurate? Does it recognize your phone or something?

EDIT: Yeah, it looks like at least Tesla has a phone Bluetooth option [0]. I can definitely see the value there.

[0] https://www.tesla.com/ownersmanual/model3/en_us/GUID-E004FAB...

I mean the car drives with bluetooth, it can be relayed sure but also ... you can enable pin to drive, and even if you drive away with the car once the relay is broken due to range the car won't start again, and also stealing a tesla this way is ... well really fucking dumb, the GPS tracking on the car, the fact the owner can literally shut down the car remotely or limit speed, personally i think remote valet mode should be allowed to set the car to 10mph max

Its about carrying shit around and losing it i carry my phone i'm not carrying a shitload of keys anymore, hell my drivers license is in a slot on my phone, so no wallet either anymore

When my keys are in mu tight pocket it is is nice to be able to open the door without taking my keys out. It is also nice to start the car without reaching for my keys.

I used to be a field guy and sitting in my car all the time. Now I use my car key twice a day. So it is less useful.

Imagine a future hack where the car's connectivity and self-driving ability is used to remotely steal fleets of cars and drive them to pop-up chop shops. Maybe this can be the plot of Fast and Furious 37 or Gone in 2.0 Seconds.

Chop shops to steal what? Tires? Window glass? There's not much to part out on an EV.

Batteries? Motors? Electronics?

Even a basic EV is chock full of parts that I pay good money with legitimate retailers for.

There's like, the whole part that makes it go that is pretty valuable.

https://stealthev.com/product/tesla-performance-rear-drive-u..., there is 12k retail, maybe a few thousand on the black market... sounds pretty lucrative.

In my experience, part out value is a function of the (un)availability of spare/replacement parts.

I’ve made decent recoveries parting out my old MacBook Airs when upgrading, like 75%+ contribution to my replacement unit (without properly accounting for my disassembly/listing/packaging/shipping time).

With an electric car, there’s some value in a motor that came out of a particular car for some other project, even if the motors don’t typically fail. Lots of franken-Tesla projects out there, just as some of my parts hit the hackintosh market.

This is an attack that probably takes two people and requires one of them to be standing extremely close to the driver and holding an electric device up to their pocket or purse. The chances of this becoming a mainstream method of stealing cars is close to zero

It’s also annoying clickbait that this works across a wide variety of cars and tech and isn’t exclusive to Tesla. If anything Tesla is less susceptible to it because at least you can also require a PIN, which some other manufacturers don’t have as an option

> Recent stats from the car security company Tracker has revealed that 92% of the cars it recovered last year were taken without using the keys. This is an increase from 2018’s figure which stood at 88% and a worrying increase of 26% compared with four years ago. The figure in 2016 stood at 66%.

Conveniently that stat doesn't say whether it's relay attacks, or just getting towed, or some other means

This applies to more than just Tesla according to the article. I’ve always been of the belief that if you have a desirable vehicle it can be stolen with enough time and ingenuity thrown at it. That’s why insurance is around for the few% of people that experience car theft

One of the fundamental laws of all security is that "if a thing can be accessed legitimately, it can be accessed illegitimately". The only question is how much time and/or effort it takes to access.

Its also just super annoying to steal a tesla, you've got to disable the redundant GPS, you've got to disable the cellular connection, because the car can be remotely tracked, hell the owner can see you in the car when you park via the 7 cameras, thats why a lot of tesla crime is broken glass and theft of stuff and not stolen teslas themselves.

> you've got to disable the redundant GPS, you've got to disable the cellular connection

$50 and a willingness to buy a jammer from eBay is all a thief needs to accomplish that.

And then tracked by satellites and locked remotely.

My brother-in-law got his car stolen one morning, by the afternoon the car was returned because it was found sitting in a parking lot.

The cops observed from a distance, waited for the thief to exit the car, and called to have the car remotely locked.

Dunno about Teslas, but I’m in a high theft country and the thieves quickly know what to remove to make that impossible before tossing the vehicle in a shipping container.

Will a Tesla stop working if it hasn’t phoned home in a while?

I mean technically as soon as the car leaves the range of the original phone, the cars not starting again you immediately get a notice that "you've left the range of your phone, the car will not drive again once parked."

Not to mention even if the guys down the road stealing the car driving away... you set it to some stupidly slow speed remotely as max, and call the cops with the location.

and again as has been said no tesla with pin-to-drive enabled as additional security has shown to have ever been stolen cause you can't really hot wire it

Vehicle Theft clearance rates vary quite a bit, but it's somewhere between 17%-30%, depending on state, of vehicle theft cases are closed via arrest!

This experience IMO is a rarity.

https://archive.is/iVhyP

I mean if your actually concerned witht his, enable pin to drive... done

Reply on news.ycombinator.com