The researchers were able to hack the Tesla Model S keyless entry system and detail how the security measures implemented in the more recent Tesla Model X were be bypassed. They were able to demonstrate how the battery powered Tesla Model X priced at over $100.000 can be stolen in a matter of a few minutes. Tesla has released an over-the-air software update to mitigate these issues.
The Tesla Model X key fob allows the owner to automatically unlock their car by approaching the vehicle, or by pressing a button.
To facilitate the integration with phone-as-key solutions, which allow a smartphone APP to unlock the car, the use of Bluetooth Low Energy (BLE) is becoming more prevalent in key fobs and the Tesla Model X key fob uses BLE to communicate with the vehicle.
“Using a modified Electronic Control Unit (ECU), obtained from a salvage Tesla Model X, we were able to wirelessly (up to 5m distance) force key fobs to advertise themselves as connectable BLE devices. By reverse engineering the Tesla Model X key fob we discovered that the BLE interface allows for remote updates of the software running on the BLE chip. As this update mechanism was not properly secured, we were able to wirelessly compromise a key fob and take full control over it. Subsequently we could obtain valid unlock messages to unlock the car later on”, explained Lennert Wouters, PhD student at the COSIC research group.
“With the ability to unlock the car we could then connect to the diagnostic interface normally used by service technicians. Because of a vulnerability in the implementation of the pairing protocol we can pair a modified key fob to the car, providing us with permanent access and the ability to drive off with the car”, Wouters added.
“To summarise, we can steal a Tesla Model X vehicle by first approaching a victim key fob within about 5 meters to wake up the key fob. Afterwards we can send our own software to the key fob in order to gain full control over it. This process takes 1.5 minutes but can be easily performed over a range of more than 30 meters. After compromising the key fob, we can obtain valid commands that will allow unlocking the target vehicle. After approaching the vehicle and unlocking it we can access the diagnostic connector inside the vehicle. By connecting to the diagnostic connector, we can pair a modified key fob to the car. The newly paired key fob allows us to then start the car and drive off. By exploiting these two weaknesses in the Tesla Model X keyless entry system we are thus able to steal the car in a few minutes”, said Dr. Benedikt Gierlichs, researcher at COSIC.
The proof of concept attack was realised using a self-made device that was built from inexpensive equipment: a Raspberry Pi computer with a CAN shield, a modified key fob and ECU from a salvage vehicle and a LiPo battery.
The Belgian researchers first informed Tesla of the identified issues in August 2020. Tesla confirmed the vulnerabilities, awarded their findings with a bug bounty and started working on security updates. As part of the 2020.48 over-the-air software update, that is now being rolled out, a firmware update will be pushed to the key fob.
