Watch how a Tesla Model S was stolen with just a tablet

Relay attack on an Essex driveway.

Watch how a Tesla Model S was stolen with just a tablet

In the wee small hours of Sunday morning, two masked criminals began to meddle with a Tesla Model S on a driveway in Essex, England.

British tech executive Antony Kennedy was about to have his Tesla Model S stolen. But only after the thieves struggled (for a while) to unplug it.

Watching Kennedy’s video of the theft, it appears that the two criminals used a “relay attack”, where a signal from a nearby key fob (in this case, out of range of the car inside Kennedy’s darkened house) is boosted to a location close to the car.

And because the Tesla Model S, as with other luxury cars, can automatically unlock itself just by sensing that someone in close proximity to it is carrying an authorised key fob, the car can be driven away in seconds.

Such “passive entry” systems may be awfully convenient and impress your non-Tesla owning friends, but if a thief manages to recreate your key fob’s signal and is able to enter and drive away with your vehicle, you may decide that they are perhaps a gimmick too far.

A Tesla, of course, comes with a GPS signal that could be tracked by police using the associated smartphone app to recover the vehicle. That’ll work - if the criminals do not manage to block the GPS signal, as they appear to have done in Kennedy’s case (who, by the way, says that Essex Police still haven’t phoned him back.)

It may be too late for Antony Kennedy and his Tesla Model S, but here are some tips for other owners:

  • Enable “PIN to drive”.
  • When you’re not planning to use your key fob, keep it inside a RFID-blocking sleeve or “Faraday pouch” to block unauthorised electromagnetic transmissions.
  • Don’t leave passive entry enabled

Kennedy tweeted troubled Tesla founder Elon Musk to moan that it was far too easy for criminals to disable remote access on stolen cars. Maybe a PIN or password would be a good idea?

Musk hasn’t replied.

Tags: , , , ,

   Join thousands of others and sign up to our free "GCHQ" newsletter.

Smashing Security podcast
Check out "Smashing Security", the award-winning weekly audio podcast, with Graham Cluley, Carole Theriault, and special guests from the world of information security.

"It's brilliant!" • "Three people having fun in an industry often focused on bad news" • Winner of the Best Security Podcast 2018

Latest episodes:
Listen on Apple Podcasts Listen on Google Podcasts

, , , ,

5 Responses

  1. Jim

    October 24, 2018 at 8:44 am #

    Some info here. Seems to suggest that if it was just a relay/amplify attack, then the thieves wouldn’t be able to start the car once they were out of range. So the tablet must have somehow recorded the signal also. Interesting stuff.

    https://www.wired.com/story/hackers-steal-tesla-model-s-seconds-key-fob/

    • Will in reply to Jim.

      October 24, 2018 at 9:56 am #

      No, they just drive the car straight to a shipping container or an area where they can move it into one easily via trolley. The key signal cannot be copied for later use as it’s a rolling code.

  2. Will Fealey

    October 24, 2018 at 9:55 am #

    Elon did respond > https://twitter.com/elonmusk/status/1054060263257792512 & Tesla unlike Jaguar/Land Rover forced/turned off passive entry remotely for all cars in the UK, they then added an optional ‘pin to drive’ system and emailed all owners explaining the risks.

  3. John

    October 24, 2018 at 10:09 am #

    Elon Musk replied three days ago
    https://twitter.com/elonmusk/status/1054060263257792512

    • Graham Cluley in reply to John.

      October 24, 2018 at 10:50 am #

      Ah. Thanks for that. I think the reason I missed it is that he didn’t actually reply to Anthony Kennedy, but someone else who retweeted Anthony’s message.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.