Josep Pi Rodriguez of IOActive discovered a new NFC relay attack that could potentially be used by thieves to steal a Tesla Model Y in seconds without its owner noticing. These near-field communication (NFC) cards enable Telsa owners to unlock their vehicles and start the engine by simply tapping the it against embedded reader in the driver’s side body of the car.
More specifically, Tesla Model Y owners hold the keycard up to the middle B-pillar and the vehicle then detects the nearby card before issuing a cryptographic challenge over NFC. The smart keycard also calculates the correct response and replies using NFC to enable the vehicle to validate the response before opening the doors. The driver then has approximately 2 minutes to start the car and drive before the keycard needs to be validated again. What this attack requires is a Proxmark RDV4.0 to mimic NFC devices, while the second person has to get close to the target’s keycard with a NFC reader equipped smartphone. The Proxmark and smartphone then communicate over Bluetooth or Wi-Fi to trick the Tesla Model Y into unlocking itself. By simply enabling the PIN-to-drive function, this attack can be prevented entirely. We’d like to see someone try this on a Tesla Model 3 with tank tracks.
- Echo Dot is a voice-controlled speaker that uses Alexa to play music, control smart home devices, make calls, answer questions, set timers and alarms,...
- Play music from Amazon Music, Apple Music, Spotify, Pandora, SiriusXM, TuneIn, and iHeartRadio.
- Call or message family and friends hands-free, or drop in from the Alexa App to your Echo device.
To fix this issue is really hard without changing the hardware of the car — in this case the NFC reader and software that’s in the vehicle. The communication between the first attacker and the second attacker takes only two seconds [currently], but that’s a lot of time. If you have only half a second or less to do this, then it would be really hard,” said Rodriguez.
