Security researchers hack, steal Tesla Model X within minutes

The Elon Musk-run Tesla has released an over-the-air (OTA) software update to mitigate the security issues in its key fobs software.

London: A group of Belgian cyber security researchers has discovered major security flaws in the keyless entry system of the Tesla Model X, demonstrating how the battery-powered Tesla Model X priced at over $100,000 can be stolen in a few minutes.

The Elon Musk-run Tesla has released an over-the-air (OTA) software update to mitigate the security issues in its key fobs software.

---

Researchers from COSIC, an Imec research group at the University of Leuven in Belgium, spotted the security flaws. Imec is a world-leading research and innovation hub in nano-electronics and digital technologies.

The same researchers earlier hacked the Tesla Model S keyless entry system. The Tesla Model X key fob allows the owner to automatically unlock their car by approaching the vehicle, or by pressing a button. To facilitate the integration with phone-as-key solutions, which allow a smartphone APP to unlock the car, the use of Bluetooth Low Energy (BLE) is becoming more prevalent in key fobs.

The Tesla Model X key fob is no different and uses BLE to communicate with the vehicle.

“Using a modified Electronic Control Unit (ECU), obtained from a salvage Tesla Model X, we were able to wirelessly (up to 5m distance) force key fobs to advertise themselves as connectable BLE devices,” said Lennert Wouters, a PhD student at the COSIC research group.

By reverse engineering the Tesla Model X key fob, he discovered that the BLE interface allows for remote updates of the software running on the BLE chip.

“As this update mechanism was not properly secured, we were able to wirelessly compromise a key fob and take full control over it. Subsequently we could obtain valid unlock messages to unlock the car later on”, Wouters said in a statement.

The Belgian researchers first informed Tesla of the identified issues on August 17 this year.

Tesla confirmed the vulnerabilities, awarded their findings with a bug bounty and started working on security updates.

“With the ability to unlock the car, we could then connect to the diagnostic interface normally used by service technicians. Because of a vulnerability in the implementation of the pairing protocol we can pair a modified key fob to the car, providing us with permanent access and the ability to drive off with the car”, Wouters further explained.

The researcher could steal a Tesla Model X vehicle by first approaching a victim key fob within about 5 metres to wake up the key fob.

“Afterwards, we can send our own software to the key fob in order to gain full control over it. This process takes 1.5 minutes but can be easily performed over a range of more than 30 metres

“After compromising the key fob, we can obtain valid commands that will allow unlocking the target vehicle”.