News for hackers. Stuff that matters.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by bjt2n3904 on Tuesday May 17, 2022 @05:22AM (#31407894)
I've never understood car makers obsession with proximity unlock.

Let's put it this way: I use biometrics for my phone as convenience, but I have it time out in an hour, and require a pattern. (Or, if I put the phone in lockdown.) The security biometrics offer is too weak to trust.

But imagine if the only option you had was face id, and all other options were removed.

Operations like unlocking the door must be explicit, not implicit. I'd accept configurability, but it would be permanently disabled if I could.

Bluetooth has always sucked, but even if Bluetooth is improved, proximity unlock is brain dead for security.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by dotancohen on Tuesday May 17, 2022 @05:42AM (#31408055)

  > I've never understood car makers obsession with proximity unlock.
The competition has it. Some people like it.

And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door, no steel key to manufacture, no rod going to a physical unlock switch, and no physical unlock switch. So we've saved 500 grams in the car and probably a good $20 too, no to mention the room in the door for the rod and the physical switch, which add engineering work.

There is a long tail of removing grams and dollars from the car manufacturing process, and 500 grams and $20 is significant. This long tail is why e.g. the Model 3 uses a touch screen for most controls, why the rear glass extends far into the roof, and many other seemingly-"premium" features of the Model 3. It's actually cheaper to manufacture them this way.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by riffraff on Tuesday May 17, 2022 @05:54AM (#31408152)
but why use _proximity_ ?

You may just as well require a click on the key fob or phone, the cost savings would be exactly the same.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by brianwawok on Tuesday May 17, 2022 @07:18AM (#31408778)
It’s great. Walk up to car get in and push gas. Stop it and walk away. No locks to fiddle with, it just works.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by bjt2n3904 on Tuesday May 17, 2022 @05:59AM (#31408187)
> And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door...

This is precisely what I mean by "brain dead". You'll forgive the hostility, but this is exactly what I'm talking about!

Nothing about this list of things REQUIRES proximity unlock. You can still require the user to push a button on their key fob to explicitly unlock the door.

I get the convenience factor, I do. If that's a feature you enjoy, then great! All the happiness for you. But give me the chance to opt out of something that is deeply broken from a security perspective.

Let me press a fscking button to unlock my car, instead of my car deciding I probably want it to unlock.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by diblasio on Tuesday May 17, 2022 @06:44AM (#31408512)
Setting up the proximity unlock is a manual step and decision you make. You can just not do this and use the keycard + pin if you're wanting more security.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by einarfd on Tuesday May 17, 2022 @06:22AM (#31408352)
I believe I've seen a setting to setup a pin code to drive on my Model 3. You can also unlock the car with the cards that came with it instead of setting up the app on your phone and using Bluetooth. It would be a bit clunky, but it would work. There is also a keyfob you can buy (https://shop.tesla.com/product/model-3_y-key-fob), not sure if that uses Bluetooth or not, and is vulnerable though.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by bratwurst3000 on Tuesday May 17, 2022 @06:41AM (#31408499)
Yes opt out is completly missing with electronic cars. I hope some day it will be mandatory. All those „features“ are useless to me and only freaking me out.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by raverbashing on Tuesday May 17, 2022 @06:15AM (#31408300)
Exactly.

Customers "pushing for convenience" are unaware of the possible security implications of it (to put it in a polite way). And it is absolutely the duty of manufacturers to shut them away from stupid crap like that.

Ask any consumer if they want a Pony and they will say yes.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by brianwawok on Tuesday May 17, 2022 @08:07AM (#31409265)
Glad you aren’t my car manufacturer.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by raverbashing on Tuesday May 17, 2022 @08:42AM (#31409671)
Sure, you're free to pick the best solution for you. I'd opt for the most reliable one.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by the_mitsuhiko on Tuesday May 17, 2022 @05:35AM (#31407994)
> I've never understood car makers obsession with proximity unlock.

Presumably because the feature is well liked. I rarely every use the buttons on my keyfob but always use proximity lock/unlock because it's just much more convenient in practice.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by Ekaros on Tuesday May 17, 2022 @05:55AM (#31408157)
I would love to have it. It would mean that I would not need to remove key from my pocket if there was also push to start. It always annoys me when I'm carrying something having to fumble and get it out of pocket. Just to press button and then insert it.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by dzhiurgis on Tuesday May 17, 2022 @08:45AM (#31409710)
My car ties the keys to seat memory - since we share car it's super nice not to fiddle with that. Also just having it somewhere in your pocket, doesn't require you to search for it.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by Tepix on Tuesday May 17, 2022 @05:44AM (#31408079)
My latest car has it and it wasn't optional. I had to buy a faraday bag for my car key.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by msh on Tuesday May 17, 2022 @08:48AM (#31409741)
Proximity unlock makes a huge difference when you have a kid on one arm and groceries on the other. You might still be able to operate the doorhandle without putting stuff down but not fiddle around in your pockets.

Also teslas dont force proximity unlock, its up to you to set it up.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by is_true on Tuesday May 17, 2022 @06:35AM (#31408455)
People love the feel of smart things and a car that unlocks itself when you get close does that. It's your own butler, it makes you feel important.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by yreg on Tuesday May 17, 2022 @06:34AM (#31408441)
Proximity unlock is one of my favourite features of my car.

I live in a safe region and don't mind having my car unlocked when I'm near it. If it was manual I wouldn't lock it anyway.

I agree that it should be configurable, which on Teslas I believe it is.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by diebeforei485 on Tuesday May 17, 2022 @05:30AM (#31407963)
Auto-lock when out of proximity is a great feature.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by bjt2n3904 on Tuesday May 17, 2022 @05:36AM (#31408013)
It absolutely is! Locking can be implicit -- the assumption should be that the user wants things secure.

But imagine working for a company that is very excited about their AI firewall, that intelligently OPENS ports based on a machine learning algorithm.

"No! That's a terrible idea!" You exclaim, pulling out tufts of hair. "That has more security holes than a slice of swiss cheese!"

"Yeah, but all our focus groups really liked the feature, and when customers hear AI and algorithms they're more likely to buy... Come on, you'd have to basically have a PhD to exploit an algorithm...."

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by roomey on Tuesday May 17, 2022 @05:54AM (#31408151)
Not to be facetious but there are security products advertised as such (intelligent learning of application behaviours etc etc.