Compromising the Tesla Model X Keyless Entry System
KU Leuven researcher Lennert Wouters reverse engineers the Tesla Model X BLE key fob and pairing protocol, unlocking and driving away the car in minutes.
Summary
The Architecture of the Tesla Model X Keyless Entry
The Tesla Model X utilizes Bluetooth Low Energy (BLE) key fobs to communicate with the vehicle Body Control Module (BCM) for hands-free passive entry.
Reverse Engineering the Key Fob Firmware and BLE Protocols
Lennert Wouters extracts and reverse engineers the key fob firmware, discovering an unauthenticated firmware update mechanism over the BLE link.
Crafting the Relay and Key Extraction Attack
Using an inexpensive Raspberry Pi and CAN diagnostic tool, Wouters pushes rogue firmware to the fob via BLE, extracts cryptographic unlock keys, and drives off.
Over-the-Air Patching and Hardware Security Modules
The presentation details Tesla's coordinated response, including over-the-air firmware updates that enforced cryptographic signing on key fob updates.
Related talks
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Car Hacking Village·26 min
collin · oblivion
Reverse engineers a commercial odometer rollback tool, extracting locked STM32 firmware and showing how CAN messages are intercepted and rewritten.