Vulnerabilities and security flaws in vehicle security systems aren’t as surprising for us as it is that even the most renowned car manufacturers aren’t able to provide consumers with fool-proof systems. Wired reports that Tesla recently fixed a vulnerability in the security systems of its cars after a group of researchers in Belgium proved that the Tesla Model S key fobs could possibly be remotely hacked or cloned. The vulnerability was rather a crucial one and was neglected by Tesla for a long time.
According to the findings of KU Leuven University, Belgium, the cloned signal can be easily used by malicious threat actors to unlock the car and even start the engine. All of this can be performed within two seconds without alerting the owner.
See: Hacker unlocks vehicle for a family who’d lost keys months ago
The team of researchers will be presenting the findings on Monday at the Cryptographic Hardware and Embedded Systems Conference in Amsterdam. During the presentation, the team will be explaining how the encryption of the wireless key fobs of Model S car from Tesla was broken. A video has also been created to explain the hacking process, which can be viewed here.
Theoretically, the hacking can be carried out on any car that possesses a wireless key fob. The reason being that almost all fob entry systems work in a similar manner, that is, when the owner presses the unlock button an encrypted code is sent by the fob to unlock the door and start the car.
Pektron is the company responsible for providing the keyless entry system for Tesla vehicles. It is reported that Pektron uses a weak encryption method for unlocking the car since researchers were able to successfully create possible code combinations table of 6tb out of which around 2^16 were authentic keys.
Even if the table is ignored, a hacker can perform the hack attack using just a Yard Stick One radio, a Raspberry Pi mini-PC, and a Proxmark radio along with a USB drive and batteries. Researchers used these devices to perform the hack, as evident from the video. These devices aren’t too expensive but can cause greater trouble for the Tesla car owners.
See: Watch thieves steal keyless Mercedes within 23 seconds
Researchers claim that they identified and reported the vulnerability to Tesla back in 2017 and were paid $10,000 reward by the company but the flaw wasn’t fixed until recently. In response to this, Tesla issued a statement, which read:
“Based on the research presented by this group, we worked with our supplier to make our key fobs more secure by introducing more robust cryptography for Model S in June 2018. A corresponding software update for all Model S vehicles allows customers with cars built prior to June to switch to the new key fobs if they wish.”
In July 2018, Tesla did warn consumers about the likeliness of cryptographic-based risks and also urged users to disable passive entry features. The company also went a step ahead and added a PIN code with 2FA authentication to the vehicles’ anti-theft system in August. With these measures, Tesla aimed to mitigate the risk of fob hacking. However, customers need to update the software to enjoy enhanced security.
