Video shows how a $80,000 Tesla was stolen with a $20 device

[RV_]

Info for all brands with key-less entry and phone key entry and start in the second article at the bottom of this one. This method works on any other brand car, gas, diesel, or EV, with Bluetooth proximity key-less entry and starting which many cars are equipped with today - Not just Tesla. (Sheesh!)

Tesla gets a lot of attention when anything negative comes up. If they have one fire it gets on world news, yet the many thousands of car fires in ICE vehicles go without even a local news story.

This article is another example of clickbait using Tesla in the title deceptively. Then a bunch of numb-noggins will go around saying "see Teslas are vulnerable! I saw it online." If you read the article it's all vehicles with phone key and other remote entry and start systems the simple workaround is to use the individual four digit pin in addition to the phone key keyless proximity entry systems. For us our car has a four digit pin for the glove-box and a separate four digit "pin to drive" can also be set that must be entered just like our computers before it will turn on or go into gear. As well these thefts usually are not done on cars parked in locked garages. Ours are parked in our garage with a high security Chamberlain current model garage door opener, and I can program an individual pin on my car as well. They might unlock it but can't drive it away from a public parking lot without entering the correct PIN if enabled.

So here is the deceptive article and video. Deceptive because it leaves out any mention that it works on all cars with proximity phone keys and fobs.

Excerpt:

"A team of YouTubers from Donut Media, a Los Angeles-based company that runs an eponymous channel, managed to break into a Tesla vehicle with a $20 device. Yes, you read that right.

In the video, Donut Media's Jeremiah Burton demonstrates how he was able to "steal" a Tesla using a relay attack. Sultan Qasim Khan, the main security consultant and researcher of NCC Group, is also with him throughout the video. Khan appears to have discovered a type of relay attack that works on Tesla vehicles. Khan states that he built a relaying device for as little as $10 using "free software" and "off-the-shelf hardware." Because two of these devices are required, the total cost came to $20.

In the video, they successfully obtained entry into the $80,000 Tesla vehicle, starting it and driving it away with a message to Tesla CEO Elon Musk stating "Fix it, Elon!" If you're curious to see the demonstration, make sure you watch the video embedded above, and as always, enjoy."

Source: https://interestingengineering.com/video/video-shows-how-a-80000-tesla-was-stolen-with-a-20-device

"a message to Tesla CEO Elon Musk stating "Fix it, Elon!" ? He already did by adding a pin if the owner so desires to enable it.

 

 

Here is a better article showing how to avoid relay thefts if your vehicle has key less entry and/or start. It has actual home security video of a car being opened using this electronic theft device.:

Excerpt:

"Keyless car theft: What is a relay attack, how can you prevent it, and will your car insurance cover it?

While the pandemic and multiple lockdowns might have reduced car theft over the last year or so, the UK police forces are warning that it’s on the increase again.

The National Police Chief’s Council showed there was a 3.1% increase between May and June this year – with most of the increase due to keyless car theft. Or to give it its proper term, relay car theft.

Intelligence shows organised crime gangs are using relay technology to receive the signal from a key inside a house and transfer it to a portable device, allowing them to unlock and drive the car. All in a matter of minutes.

So what is relay car theft?

Many new cars now have keyless entry systems, or can have them added as an upgrade. This allows the driver to open and start the car without using a button or turning a key so long as the fob is nearby.

Thieves are exploiting this, using sophisticated technology to hack into your car’s computer, meaning they don’t even need a key-fob to start the vehicle and can drive it away in a matter of minutes.

In fact, 96% of motorists are at risk of having their car stolen by criminals using the latest theft technique, according to figures from security company Tracker.

The most at-risk are cars that use keyless fobs, as well as ‘connected cars’. In other words those that use internet to access maps, travel info and music – basically anything with an internet-enabled infotainment system."

Much more in the article below including simple free and cheap was of how to prevent it.

Top tips on how to avoid vehicle theft and relay attacks

• Block electronic key fob signals: A Faraday-style wallet, as pictured above is the best way to block out any electronic signals, but even your fridge can shield electronic car keys from relay attacks.
• Check it’s locked: Always double check that your car is physically secure and alarmed when using keyless locking systems.
• Keep keys out of sight: Leaving keys in the hallway or on the kitchen worktop means thieves can easily employ the relay technique if it is within proximity or failing that break in and swipe them.
• Add layers of security: Physical barriers can be effective in deterring thieves. Consider adding a crook lock or wheel clamp to your car.
• Install a ‘ghost immobiliser’: For another layer of protection, add a secondary barrier to your car’s factory fitted immobiliser by having a unique access code to start your car.
• Invest in a tracking device: A tracking device won’t stop your vehicle being stolen, but it significantly increases chances of police recovering and returning it.

“It’s clear from our survey that many people are unintentionally leaving themselves vulnerable to these kinds of attack, by putting their keys in easy reach of  relay devices”, concluded Barrs.

Further research by Tracker revealed that 50% of those surveyed leave their keys either in the hallway of their house or a key pot elsewhere. Only 4% use a metal container to ensure their car is protected from a relay attack."

Source:

https://leasing.com/guides/relay-car-theft-what-is-it-and-how-can-you-avoid-it/

Safe Parking!

Edited July 17, 2022 by RV_

[durangodon]

1 hour ago, RV_ said:

This method works on any other brand car, gas, diesel, or EV, with remote key-less entry and starting which many cars are equipped with today - Not just Tesla.

I watched the video, pretty impressive how techie types can come up with hacks for stuff like this.  However, your statement is not accurate.  Many, many vehicles have keyless entry and starting and this method would not work.  It only works on a vehicle which the phone is nearby and continues to send out the code to the vehicle and doesn't require an actual key to be placed in the ignition. 

My Chevy pickup, for example, may be unlocked and started with a similar hack, but only if I'm nearby activating the key fob.  My key fob does not send out a signal unless I push the button on it, no way for a thief outside my home to steal the code.  It also can't be driven off without using the physical key inserted into the steering column.  The key unlocks the column and allows the truck to continue running after the initial few minutes.

The second article claims 96% of cars can be stolen using this method.  I doubt that many cars even have remote starting capability.

[Kirk W]

1 hour ago, durangodon said:

The second article claims 96% of cars can be stolen using this method.  I doubt that many cars even have remote starting capability.

Car theft statistics 2022

 

Motor Vehicle Theft by Vehicle Make and Model (NCIB)

VEHICLE	MODEL YEAR MOST FREQUENTLY STOLEN	THEFTS
Ford Pickup, Full Size	2006	38,938
Honda Civic	2000	33,220
Chevrolet Pickup, Full Size	2004	32,583
Honda Accord	1997	30,745
Toyota Camry	2007	15,656
Nissan Altima	2015	13,355
Toyota Corolla	2018	12,137
Dodge Pickup, Full Size	2001	11,292
GMC Pickup, Full Size	2018	11,164
Honda CR-V	2001	10,094

[RV_]

Durango Don, is this article clearer for you?

From Austin Texas May 15

"Cars with keyless entry and keyless start are becoming a growing target for thieves. The keyless convenience is being exploited by crooks so they can quickly and quietly pop the locks.

“They’re very bold,” said Jason Flenniken who lives in a south Austin neighborhood.

Flenniken says his street and several others in his neighborhood were recently hit by crooks using relay devices that can hack key fobs. Cameras positioned around Jason’s home caught a guy rummaging through his car. It wasn’t a relay attack because camera footage shows the doors were accidentally left unlocked. But down the street, locked cars were no match for the relatively simple hack.

 

Caption: Alternatively, inexpensive “RFID sleeves” and “Faraday bags” are available that have metal mesh linings that will shield a key fob from sending or receiving radio signals.

“There were at least three people that were roaming around our particular street,” said Flenniken. “I know in the neighborhood that night we had a lot more valuables stolen, and two actual cars were taken that night.”

Video from a keyless car theft in England shows how it works. Two crooks are needed to pull it off. One goes to the front door where a lot of people store their keys. That signal is then amplified and relayed to the second device that’s being held close to the car door. The car is tricked into thinking the key fob is next to the door. That allows the car to be opened, started, and driven away.

“With a relay attack all you’re really doing is kind of putting an extension cord on your key fob,” said Flenniken. “It’s too easy to do, unfortunately.”

AAA is trying to raise awareness about keyless car thefts.

“A lot of drivers are not aware of this ability for thieves to steal their vehicle by simply just standing outside of their home,” said Daniel Armbruster with AAA Texas.

AAA says that across the United States, there have been reports that thieves are using power amplifiers to boost the signal from vehicle owners’ key fobs and unlock car doors.

“This can happen to you. It’s not something that’s just a high-tech idea or sci-fi fantasy. This really is happening and, of course, many drivers are finding out the hard way,” said Armbruster.

Keyless car thefts generally take less than two minutes, make little noise, and leave behind no broken glass as evidence a crime has even taken place. AAA says there’s a simple way to protect one of your most expensive pieces of property.

“Don’t leave your key fob in an area near the front door,” said Armbruster. “When you’re at home, store your car keys or fob in a metal cabinet or with some sort of device that protects the radio signal from being intercepted.”

Flenniken is taking that advice. Instead of hanging his keys by the door, he plans to put them in a metal box that will block the key fob’s signal from being transmitted.

“We actually ordered one. Put that by your front door and just drop your keys in that,” said Flenniken. “You have to set yourself up to not be an easy target.”

The Austin dad is also putting more cameras in his front yard and plans to be diligent about locking his car, so he’s better prepared the next time thieves target his neighborhood.

“It was just our turn and it will probably happen again,” said Flenniken.

Here are some other precautions AAA says drivers can take:

• Don’t leave valuable items (purses, GPS units, shopping bags, or electronics) in your car. If you must do so, make sure they are out of sight in a locked glove box or trunk
• Park your car in a closed garage; this makes it a far less inviting target.
• Store your key fobs (all of them) in a metal container or tin foil when not in use.

Alternatively, inexpensive “RFID sleeves” and “Faraday bags” are available that have metal mesh linings that will shield a key fob from sending or receiving radio signals."

https://www.msn.com/en-us/autos/other/car-thieves-are-hacking-key-fobs-to-quickly-and-quietly-steal-vehicles/ar-AAXcEbT

Edited July 16, 2022 by RV_

[durangodon]

10 minutes ago, Kirk W said:

Car theft statistics 2022

 

Motor Vehicle Theft by Vehicle Make and Model (NCIB)

VEHICLE	MODEL YEAR MOST FREQUENTLY STOLEN	THEFTS
Ford Pickup, Full Size	2006	38,938
Honda Civic	2000	33,220
Chevrolet Pickup, Full Size	2004	32,583
Honda Accord	1997	30,745
Toyota Camry	2007	15,656
Nissan Altima	2015	13,355
Toyota Corolla	2018	12,137
Dodge Pickup, Full Size	2001	11,292
GMC Pickup, Full Size	2018	11,164
Honda CR-V	2001	10,094

I never said vehicles couldn't be stolen.  That's been happening since they were invented by a variety of methods.  I said that 96% of cars don't have remote starting.

[Chalkie]

1 hour ago, durangodon said:

My Chevy pickup, for example, may be unlocked and started with a similar hack, but only if I'm nearby activating the key fob.  My key fob does not send out a signal unless I push the button on it, no way for a thief outside my home to steal the code.  It also can't be driven off without using the physical key inserted into the steering column.  The key unlocks the column and allows the truck to continue running after the initial few minutes.

The second article claims 96% of cars can be stolen using this method.  I doubt that many cars even have remote starting capability.

As I read it, this is NOT the type of ignition. My daughters Audi does not require a physical key as it is push button start which is not what your truck is.

[durangodon]

2 minutes ago, Chalkie said:

As I read it, this is NOT the type of ignition. My daughters Audi does not require a physical key as it is push button start which is not what your truck is.

Exactly.  Newer vehicles with push button start use either a fob or your phone to determine that you are within bluetooth range of your vehicle, thus allowing you to push the button and start the car.  Those fobs and your phone are constantly trying to communicate with your vehicle in order to know when you are in range.  A thief within range of the fob or phone uses his device to relay the signal to another thief within range of the vehicle.

However, most cars on the road don't use that technology.  RV's statement that "This method works on any other brand car, gas, diesel, or EV, with remote key-less entry and starting" is not accurate.  Vehicles like mine which have both keyless entry and starting require that I push a button on the fob.  A thief would have to be nearby to me when I pushed the button on the fob in order to intercept the signal.  Standing outside my house trying to steal a signal wouldn't work.

[RV_]

Don it is referring to remote opening by proximity and can work on any car that senses the fob or phone as key proximity to unlock.

It will work with any brand so equipped. As described in each article. Your key fob can also be read in many cars as stated and you iterated yours could be by another hack other than the relay hack thus I included the second article.

My Tesla does not do remote start that I know of because the heater does not need warmed radiator water going through a heater core to work, it has a heat pump for both heat and A/C.

The proximity unlock I will continue to use with my PIN to drive. If I doisable the pin to drive my Y requires me to get in and press the brake pedal once unlocked and I am in to start the car which is silent, I just see the error symbols go off and my gear P, R, D show up. Then it is ready to put in R and back out of the garage.

If you have a FOB it can be hacked. Some ways harder/more obvious than others.

The point of the article posted was to let you and others be aware of more than one method of stealing your vehicles. If you have an old 12 volt positive pre-1947 truck without any electric locks at all of course it won't apply.

It is up to each to do their own due diligence. Apparently you did for yours.

Edited July 16, 2022 by RV_

[durangodon]

21 minutes ago, RV_ said:

Durango Don, is this article clearer for you?

The first article was plenty clear to me, and I believe it.  They are referring to vehicles which have push button start and never use a key.  As I explained above in my response to Chalkie, those fobs and phones are constantly trying to communicate with the vehicle.  The thieves intercept that communication and use it to hack into the car.

Most vehicles with keyless entry and starting do not use that technology.  The fob must be physically activated by pushing a button.

[RV_]

I added what the article says already and from the start Bluetooth Proximity to my intro. That should make it clear that this will work on any vehicle so equipped for the method outlined in the article as I said from the start. 🙄

[RV_]

I hope everyone looks at their vehicle's security systems to see if they are vulnerable to any of the the proximity or fob hacks.

These articles have made me consider my security options with my cars, and apply to many newer cars today ordered with proximity setups. I did not see the need for the pin on my car, and still don't, but it is so easy to punch in, I am thinking about using a pin to drive.

If your car can sense your phone or Fob proximity and lock it when you leave as well as unlock it when you get back and close enough like mine that is really convenient. Since I have a big touchscreen in the car it is no problem to punch in the pin.

However if you have not read the article it takes two people with computers and/or the device to make the relay hack work. First one needs to be within range of my phone's Bluetooth and the other next to my car. Then as one gets my phone signal it is relayed (thus the name Relay hack) to the other and the car unlocked to steal valuables or drive it away, theoretically.

It won't work with my car in the garage, unless they break open the garage door which would have already set off our ring camera alerts, and the sound of the garage door opening makes my dog go crazy. Which would cause us to go check with our security team of Mr. Smith and Mr. Wesson. We electronically lock the garage door so even our garage door openers and outside keypad won't work until unlocked from the inside keypad.

Someone would have to follow me into a store or whatever and get close enough to get my signal with the device. They aren't all that stealthy, I would likely notice a guy following me around a store with that equipment since I am techie oriented, so it's harder to be stealthy doing the relay hack.

However I can just turn off Bluetooth on my phone when I leave the car and voila' no security risk. I don't use near field (NFC) to pay from my phone touch free or with a tap so I do not need NFC on, nor Bluetooth, in a store or other place while parked.

I think the biggest risk is to folks with phones/fobs with Bluetooth as proximity keys parking their cars outside their house or RV at night not in a garage. I do not have the proximity sensing FOB just my phone and our two key cards that also will unlock and turn the car on. The cards must be placed on a spot on the outside and on a certain part of the console to drive.

Instead of a start button just pressing and holding the Tesla brake for a second does that.

We actually have four key options. I prefer the Phone but am leaning towards getting the ring that op[ens it.

https://seventrumpet.com/enable-pin-to-drive-on-tesla-cars/

 

 

Edited July 17, 2022 by RV_

[durangodon]

RV, I'm curious about the Tesla.  I know that you use the pin, so this doesn't apply to you.

So, if someone did use the relay hack method to enter a Tesla and start it up, once they drove a block or so and out of range of the fob/phone, would the Tesla quit running?  Or, is the fob/phone relay only necessary to get it started?

 

[RV_]

I do not know but the same thing occurred to me to test.

"There was a case last week here in Australia where the thief just got in the Model 3 and drove away because the owners phone was only 3 metres away (through a wall) which was still close enough to be able to start the car. Guy got about 5km away when he put it in park, but couldn't get it back into drive again without the phone or keycard. Car was recovered with no damage or anything missing (although the guy who stole it posted a photo and video on instagram of him driving it, moron). So Pin to drive would have prevented this."

Source:

https://teslamotorsclub.com/tmc/posts/4413564/

 

 

[RV_]

Since there is a hack that can make a key if they can force me to use my key card by jamming my phone's Bluetooth, forcing me to use the NFC key card, I think the phone and a pin is safest. And no real PITA to do.

[Kirk W]

14 hours ago, durangodon said:

I said that 96% of cars don't have remote starting.

The data that I posted supports that opinion and that is the reason that I posted it. I doubt that there are many Tesla cars in the RV community but there are a lot of some others on that list.  We just attended the annual Escapade and as part of security I saw pretty much every vehicle there and the only EV that I saw was not Tesla. 

Edited July 17, 2022 by Kirk W

[RV_]

11 hours ago, Kirk W said:

We just attended the annual Escapade and as part of security I saw pretty much every vehicle there and the only EV that I saw was not Tesla. 

Yes if you were off topic on Proximity hacks for owners of new cars. My opening statement was that Tesla is not alone but it made the headlines and I pointed out that many new cars are coming out with Proximity tech. Info for all who have or might buy a new car.

Are you saying only EVs have proximity keys?

Are you saying no RVrs will buy new cars, some with proximity keys?

I think you and a few others missed the point that the original video should have been about a variety of brands with proximity keys.

I chose to pass along to my friends here to be aware of the things that can be done if you have the convenience of the proximity key in your Nissan, Mercedes, Jeep, Malibu Hybrid, Miata etc that all have Proximity keys among a lot of others.  Just like when key Fobs came out lots of folks were naysayers about them too. Sour Grapes were written about by Aesop and human nature has not changed much today.😉

If there is a Tesla article about a fire it will be debated hotly and most likely posted by folks who have posted when the stock is down but never when it is up.

A great example of the bias here is the article I posted in finances about the very large Ford recall for actual fires right now, and the advisory by Ford not to park them inside until the recall is done. No comments there Kirk? No one to point out that not everyone has a Ford? Or my punctuation was wrong? 🤣

The point Kirk, and the topic, I will state again, is that Proximity keys are coming out in all brands and can be defeated - it isn't a Tesla only problem.

If any of our RV friends here has one of these very convenient technology devices I wanted to pass along the info.

As I pointed out in the first post, there are some steps that can be taken. That just confirmation bias. Is your next move going to be to start a survey asking who would want a Proximity key?

I assumed folks were aware of the new car options and standard devices like proximity locking and unlocking keys/apps, fobs, and rings worn on your finger. It makes no difference if you want them or not. You cannot stop progress only complain about it, ignore it, or embrace it, not stop it. And proximity entry isn't just in expensive cars. I picked an older 2019 article to show these are nothing new.

So Kirk how many of those cars you saw that were not EVs were new cars and not economy ones? How would you know if it had it or not since my topic is the tech of proximity keys on any brand with them, and as you can see if you did a search for new cars with Proximity tech instead of how many cars were stolen and how many EVs you saw at the show? The cars with proximity keys in the article below has not one EV in it, and there are many more since 2019 when this wa published. MY Tesla Model Y was not even in Production until 2020, and today there are many more.

 

"10 Best Cars With Keyless Entry Systems

Published Aug 15, 2019

 

Cars with keyless entry systems are becoming more common, and these are the absolute best models available on the market.

Excerpt:

"Today, the most common features in the majority of vehicles would have been unimaginable two centuries ago. Things such as cruise control, lane-keeping, automatic braking and of course the proximity key. The proximity key acts as a wireless transmitter that allows for keyless access. This cool feature is becoming more common and here are the ten best cars with keyless entry systems.

For starters, the Nissan Versa is the cheapest car in America. Retailing at just $12,460, the Versa is a sedan that is not only cost-efficient but also one of the best-value cars one can buy. The Versa, for starters, offers an incredible 40-miles to the gallon on the highway and has features such as smartphone integration and automatic braking.

The Versa also comes with a keyless entry system that allows the driver to access the vehicle by having the key on their person, and not in their hand. Additionally, the key fob for the Versa can remotely start it.

Jeep: Adding on to these fine features is the obvious keyless entry feature that offers an extra level of security and ease when operating this car. The Renegade is also equipped with some of the best parking assist tools.

Following the Jeep Renegade is another off-road vehicle, the Toyota Tacoma. The Tacoma is a reliable and safe pickup truck and offers many cool features in addition to the classic keyless entry system.

The Malibu Hybrid gets 49-miles to the gallon on the highway and has many tech features that include mobile phone integration, keyless entry, and a built-in wi-fi hotspot for riders to enjoy. The Malibu also has safety features, including lane-keeping and lane-changing systems with blind-spot detection, forward collision alerts, low-speed automatic braking, and more.

Next on this list is a Mazda MX-5 Miata."

https://www.hotcars.com/cars-keyless-entry-systems-best/

Of course not every car has proximity keys.

I remember with my old fobs and our current Forester FOB that sometimes I would not remember if I locked the car or not as sometimes I was preoccupied with my errand and forgot. So I would walk back to where I could see the car and lock it knowing by the lights flashing twice that it was then locked.

I love that proximity locking locks it automatically when I am about 15 feet away with my phone in my back pocket.

Let's remember that old tech could be hot-wired long before proximity keys were developed by breaking a window and using a screwdriver thieves would steal the car and the chop shop repaired it or stripped it.

As said in the articles, and by me, earlier in this thread, the odds of two people stealing my car in broad daylight in  parking lot with the relay hack hardware and software when all my out of garage car use is errands or a doctor's appointment is pretty remote. (pun int.) So I am on again off again about using the PIN. 

So, unless someone has something to add to the topic I hope the article is of some use.

 

Edited July 17, 2022 by RV_

[Darryl&Rita]

We had a 2016 Honda CRV with a fob key, and push button start. Kept the fobs in a RF bag when in the RV, because we couldn't get far enough away from the vehicle to disable it. Lock the doors, leave the fobs inside, walk out and Open Sesame. The 2017 Chrysler Pacifica we have now has the same issue. RF bag to the rescue. Of course, the vehicle will not only unlock, but start and drive away. As long as the thief doesn't shut it off, it's theirs to do as they please. You do get a charming notification that the fob is no longer in range, just to make sure you don't shut it off unintentionally.

[RV_]

Ford has a keypad on some of their models and that was brought up on the Maverick truck forums and apparently they have the ability to lock the keys up wit the keypad so they won't work until the keypad is manually unlocked. The guy asking did not know. Here is that discussion - https://www.mavericktruckclub.com/forum/threads/question-about-proximity-lock-smart-key.10001/#:~:text=Yes when you pull on the handle the,truck. Anyone can walk up and unlock it.

Check with Toyota in case they have a workaround like that or the Pin on mine.

However the RF bag or Faraday cage bag is no big deal if it works. One article said putting them in the refrigerator works on some. Try that and let me know if it works, as that would be a good RVr who owns a proximity keyed car owner fact to know.

Since I garage mine I have it set to always be unlocked when it is at this location and to fold in the side mirrors when I approach and unfold them automatically when I leave.

Asa side note we have Ring security cameras and there are nightly people in  groups of three with a driver and solo walking good neighborhoods checking car doors for unlocked ones. I have not seen nor heard of any folks with electronics to open them. This apparently is happening nationwide and another reason we park in the garage. It's only a matter of time before they start breaking windows more often. We get neighborhood alerts and see these videos exactly but some don't run when the security lights come on. There are from two to six every night and that is only from Ring camera owners.

My point is none of them from here show the electronics needed for the hacks to steal them - yet. But outside parked unlocked doors get checked and gone through.

Thanks for the on-topic info.

[sandsys]

Our two year old Honda CR-V has proximity door unlocking with push button starting. Dave keeps his key in his pocket when going out. I keep mine in my purse. Never need to touch them. Except to replace the batteries in them last week. Fortunately, we live in a 4th floor apartment with our car parked in the underground garage so I don't think a thief could steal it here.

Linda Sand

[RV_]

Not easily Linda. And that is the idea, the longer it takes the less likely to be stolen. Determined thieves can steal anything given time. The idea is to make it too long to risk.