In 2020, Tesla even wrote in a submitting to the US Federal Communications Fee that it might be implementing ultra-wideband in its keyless entry techniques, and that the power to way more exactly measure the space of a key fob or smartphone from a automobile would—or not less than may—forestall its automobiles from being stolen by way of relay assaults. “The gap estimate relies on a Time of Flight measurement, which is proof against relay assaults,” Tesla’s submitting learn. That doc, first turned up by the Verge, led to widespread stories and social media feedback suggesting that the upcoming ultra-wideband model of Tesla’s keyless entry system would spell the tip of relay assaults in opposition to its automobiles.
But the GoGoByte researchers discovered they have been in a position to perform their relay assault in opposition to the newest Tesla Mannequin 3 over Bluetooth, simply as that they had with earlier fashions, from a distance so far as 15 ft between their gadget and the proprietor’s key or telephone. Whereas the vehicles do seem to make use of ultra-wideband communications, they do not apparently use them for a distance examine to stop keyless entry theft.
Tesla has not but responded to WIRED’s requests for remark.
When the GoGoByte researchers shared their findings with Tesla earlier this month, the corporate’s product safety staff instantly responded in an electronic mail dispelling any rumor that ultra-wideband, or “UWB,” was even supposed to stop theft. “This habits is predicted, as we’re at the moment engaged on enhancing the reliability of UWB,” learn Tesla’s electronic mail in response to GoGoByte’s description of its relay assault. “UWB ranging might be enforced when reliability enhancements are full.”
That reply should not essentially come as a shock, says Josep Rodriguez, a researcher for safety agency IOActive who has beforehand demonstrated relay assaults in opposition to Tesla automobiles. Tesla by no means explicitly stated it had began utilizing the ultra-wideband function for safety, in spite of everything—as an alternative, the corporate has touted ultra-wideband options like detecting that somebody’s telephone is subsequent to the trunk to open it hands-free—and utilizing it as a safety examine should still produce too many false positives.
“My understanding is that it could actually take engineering groups time to discover a candy spot the place relay assaults might be prevented but in addition not have an effect on the consumer expertise,” Rodriguez wrote in an electronic mail to WIRED. “I wasn’t anticipating that the primary implementation of UWB in automobiles would clear up the relay assaults.”
Automakers’ gradual adoption of ultra-wideband safety features is not simply restricted to Tesla, the GoGoByte researchers observe. They discovered that two different carmakers whose keys assist ultra-wideband communications are additionally nonetheless susceptible to relay assaults. In a single case, the corporate hadn’t even written any software program to implement ultra-wideband communications in its vehicles’ locking techniques, regardless of upgrading to {hardware} that helps it. (The researchers aren’t but naming these different carmakers since they’re nonetheless working by means of the vulnerability disclosure course of with them.)
Regardless of Teslas’ excessive price ticket and persevering with vulnerability to relay assaults, some research have discovered that the vehicles are far much less more likely to be stolen than different vehicles resulting from their default GPS monitoring—although some automobile theft rings have focused them anyway utilizing relay assaults to promote the automobiles for elements.
GoGoByte notes that Tesla, not like many different carmakers, does have the power to push out over-the-air updates to its vehicles and would possibly nonetheless use that function to implement a relay assault repair by way of ultra-wideband communications. Till then, although, the GoGoByte researchers say they need Tesla homeowners to know they’re removed from immune. “I believe Tesla will have the ability to repair this as a result of they’ve the {hardware} in place,” says Li. “However I believe the general public needs to be notified of this subject earlier than they launch the safe model.”
Till then, in different phrases, preserve your Tesla’s PIN-to-drive safety in place. Higher that than protecting your keys and smartphone within the freezer—or waking as much as discover a vacant driveway and your automobile offered for elements.