News for hackers. Stuff that matters.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by the8472 on Tuesday May 17, 2022 @07:39AM (#31408981)
Even without measuring the distance you could require periodic re-authentication after entry to keep the car driving. If the attacker did a one-time relay to open the car and start it and then drives away they'd lose contact and thus fail the next challenge-response authentication cycle.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by LeonM on Tuesday May 17, 2022 @07:48AM (#31409056)
None of the keyless start systems do this, on purpose. Because this may lead to very dangerous situations.

Imagine your engine shutting off on the highway, and your steering wheel locks, just because the car briefly looses response from the keyfob...

Also, just about every keyless entry systems have a physical backup key, to start and drive the car in case the battery in the keyfob is empty. A periodical re-authentication would make this impossible.

Stuck in the middle of the desert with a perfectly good car, but an empty keyfob battery? Well, sucks to be you, you'll likely die, but at least your car won't be vulnerable to relay attacks!

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by the8472 on Tuesday May 17, 2022 @07:52AM (#31409096)
That doesn't mean it's impossible to prevent relay attacks, it's just that people choose not to.

Additionally, the highway scenario could also be mitigated with a warning and a grace period. The desert scenario can be mitigated with having a fallback such as having the contactless system double as a smartcard you can put into a reader or by wireless power transfer. Plus, if your contactless system fails in the desert you're screwed anyway as soon as you turn off the engine once.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by IgorPartola on Tuesday May 17, 2022 @08:10AM (#31409295)
Please don’t. Imagine I am driving and suddenly the car in front of me fails to reauth and suddenly stops in the middle of an intersection. That would be unnecessarily unsafe.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by privacyking on Tuesday May 17, 2022 @09:39AM (#31410407)
It could just only deactivate the car if the car is stationary. Problem solved.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by LeonM on Tuesday May 17, 2022 @10:03AM (#31410814)
> It could just only deactivate the car if the car is stationary.

Right, stop once for a traffic jam, car loses sync with keyfob, and you'll become a stationary target on a highway.

Better swap out those batteries in your keyfob real quick before that 18-wheeler smashes into your car with kids in the backseat!

But hey, at least your car won't be stolen!

> Problem solved.

I guess this proves my point I was trying to make in my original post. Every xx months a sensation article like this comes out, and suddenly everyone, even on HN, becomes an expert that will 'just' solve the issue with a naive solution.

Car manufacturers, hire smart engineers. If the solution was simple, they would have fixed it already. Cars are always a trade-off between safety, security, reliability, affordability and practicality.

Great that your solution makes car theft resistant, but if also kills people, it's not such a great sell...