Do you think that breaching security of new cars only applies to ordinary cars while premium or luxury vehicles are safe? If so, the following lines will probably be a surprise for you.
Key cloning, signal extensioning, jammers or code readers. These and many other smart toys of thieves make wrinkles for many new car owners. However, as the latest findings of experts show, these threats are not only a problem for the “ordinary population” and they can also bring sleepless nights to wealthier motorists who bet on the most famous brand of e-mobility in the world. Yes, we’re talking about Tesla owners who became victims to the latest exploit of convenient keyless entry, which has so far appeared to be unbreakable in Tesla vehicles.
Researchers from the company NCC Group, which deals with cyber security, claim that they have developed a tool to overcome the Bluetooth security of Tesla vehicles. The tool can remotely unlock some Tesla vehicles and allow the thief to leave without the help of a physical key.
Where did the researchers uncover the weak link?
The vulnerability is Bluetooth Low Energy (BLE) technology, which allows owners to remotely unlock their car using an app on an authorized smartphone or key fob and then control the vehicle without the need for user interaction with the smartphone or key fob. Vehicle manufacturers providing such authentication method are aware of the potential for abuse and try to design the system to be protected against various attacks. Nevertheless, the security proved to be insufficient.
How is it possible that despite the efforts of the manufacturers, the security is insufficient?
Thanks to a unique type of attack, the researchers were able to bypass existing security measures, which theoretically allow thieves to remotely unlock and then control vehicles. They simply need to place two transmitting devices within range of the BLE signal of the authorized smartphone and then the vehicle is conveniently unlocked and ready to go. Even communication over an encrypted link layer cannot indicate that an attack is in progress. Besides Tesla vehicles, however, millions of vehicles using the digital key function are at risk, as thieves can break the security with commonly available hardware.
How does a vehicle attack work?
An everyday situation – a visit to a shopping center can be an example. After long searching for a parking space, you park in the underground parking lot, lock your car with the digital key function and go shopping. Thieves watch you, one of them places one device in the vicinity of your parked vehicle, and the second thief aproaches you with the second device and they conveniently unlock the vehicle without any attention. Testing of the new developed remote unlocking tool showed both transmission devices were able to respond to a distance of literally a few steps that thieves needed to steal the vehicle.
How can Pandora help you?
Although Pandora devices also use Bluetooth technology, unlike the mentioned vehicle manufacturers, they only use this technology as a “base” on which a specific communication dialogue is built, which is additionally secured by the AES-128 bit encryption method, which is currently also used in banking sector. The method uses codes with a strictly determined expiration time and, moreover, without the presence of the so-called Bluetooth authorization tag, the vehicle cannot be opened or controlled in any other way without the Bluetooth authorization tag. Even such modern vehicles as Tesla do not have the level of security as Pandora system. This is because Pandora uses technologies that cover each other’s vulnerable weak links, so your vehicle remains secured under any conditions.
