Featured Tesla cellular App creates a "man in the middle" security flaw.

On the bright side the least likely person to want to steal a Tesla is someone who already owns a Tesla... Of course accidentally driving someone else's Tesla away could quickly go from bad to worst. Seems like an easy thing to patch and will be done quickly?

 

Is it reported that the MITM attack allows anything to be rooted, or just to allow the car to be unlocked and driven?

 

Was there just the one incident?

Ain't going to defend Tesla's poor customer support nor lack of a PR department.

 

Here's one media report of the problem, when a Vancouver Tesla owner accidentally drove off in someone else's car:

 

It's the same event. All the reports are just about what happened with this one guy.

 

Gee, I wonder why.
Could this be the reason?
CPU's gona get what CPU's get - all too often.


This is like the electric car haters that try to get hysterical about battery fires even though the ratio of gas fires to electric car fires per million miles is pretty insignificant - comparatively speaking. But don't let that stop haters from running Hysteria up the flag
.

 

Has there been a rash Tesla thefts because of this yet?

 

Tesla's are among the least stolen cars. There are strong theft deterrents since the cars can record the thief and track the cars. This is not to say they can not be stolen, but what thief or chop shop really wants its location known to the police and possible recording of them covering the cameras?

I did try to open a different tesla that was parked near mine after asking the owner. It didn't work. Not sure what went on in the Canadian incident and whether it really was the app. I would think if this was happening a lot we would hear more than one incident and I am curious to what happened.

 

Or, he could have been the owner. Not only does Bluetooth need to be activated, but the Tesla App also needs to be running. I won't tell you how many times I've only turned the Bluetooth on and forgot to launch the Tesla App. I've acted nervous while wondering why my car hasn't let me in.

Always have the Tesla card on your person in case the phone key doesn't work.

 

My unscientific test - 2020 tesla model 3 parked next to my 2018 tesla model 3. The owner of the other car did not leave her phone in the car. The Bluetooth nfc would not open her door but did mine. I tried to unlocking my phone, still nothing. My card key similarly did not work on her car. The other way the app can open the car is through internet. The cellular wifi from my phone to the cellular wifi in the cars opened my car, but not hers. I walked back to leave my phone after locking my doors with it. The cellular wifi with her phone in the app opened her car and not mine. Perhaps there is an error in keys in the one case in canada, but I doubt this is a general problem. THere have been no other reports. GM did have incidents where the same key opened more than one car, maybe this was a fluke, or a security bug. No one else seems to have been able to repllicate and I am not the only one.

That would be the other owner opening the door and remotely starting. I'm sure that can happen, and owners have left phones in teslas which leaves them unlocked and able to start. Alternatively the cars may have been put in service mode which would allow it to be started.

I've done that too. The first time I almost called my gf to bring me my key card. Now I check to see if bluetooth is on. Once it didn't work anyway and I used the app to unlock the door, and then drove.

 

It is sounding like we have one owner that forgot to turn their car off, and an oblivious one that didn't realize they got into the wrong car. The latter didn't turn off the car, or had the former restart it through the app, after getting their kids.

 

Except that there is no action needed to turn "off" a Tesla. You drive around, stop your car, put it into park, open the door, get out, close the door and walk away (with your phone) and it locks. If you forget to put it into park, this happens automatically when you open the door (with a beep and warning message on the screen). If you forget to take your phone the car does not lock. If you don't fully close the door and you walk away you get a notification message on your phone a few minutes later.

If you are using the key card to drive with it is mostly the same except when you get out of the car you have to tap the card on the driver's B pillar to lock the car.

Mike

 

Phone in car, anybody drive off with it? How obvious is it that the car didn't lock when walking away? Can any alerts for that be turned off?

What is the range between the phone and car? Could Mr. Oblivious have gotten to the wrong car while the owner was still close enough?

Doesn't the car and phone need to be paired up before they even would exchange key codes? I know it's possible to access a phone through BT without permission, but wouldn't that be a separate glitch to the one letting the Tesla app on the wrong phone access the car? If a Tesla sniffs every phone that walks by, couldn't anyone down load the app to access a car?

 

In our 2018 MX that we sold, you could step out - not even close the door, & it closes / locks / shuts down by itself. Height of superfluous car tech
LOL

.