Josep Pi Rodriguez, Principal Security Consultant, walks you through the proof-of-concept and technical details of exploitation for IOActive’s recent NFC relay attack research on the newest Tesla vehicle, the Model Y.
To successfully carry out the attack, IOActive reverse-engineered the NFC protocol Tesla uses between the NFC card and the vehicle, and we then created custom firmware modifications that allowed a Proxmark RDV4.0 device to relay NFC communications over Bluetooth/Wi -Fi using the Proxmark’s BlueShark module.
It’s well-known in the vehicle security industry that NFC relay attacks (as well as Radio Frequency relay attacks) are a serious issue, and that they’re currently being used to steal cars. This type of attack consists of relaying cryptographic material between the vehicle and the virtual key (NFC card or smartphone).
Here you can find the paper with full technical details:
Also, there are 2 videos where you can see the attack in realtime:
Attack in testing environment with logs.
The Proxmark device is connected to a laptop with USB cable to show the Proxmark’s logs in realtime on the laptop’s screen. The Tesla NFC card is placed on an USB NFC reader that is connected to another laptop to show the logs of the python tool created during the initial phases of testing. This second laptop with the python tool will act as the smartphone that the mule will use in the real attack.
Attack using Proxmark and smartphone on the streets.
In the second video, we demonstrate the attack in a more real-world scenario using the Proxmark and the smartphone application. The first attacker waits for the victim to leave the car, then gets close to the vehicle’s reader with the Proxmark. In the meantime, the second attacker will get closer to the victim and use a smartphone to read the Tesla NFC card in the victim’s pocket.
About final thoughts:
Time limitation seems to be very
permissive, and it was possible to
perform this attack via Bluetooth from
several meters away, as well as via Wi-Fi
with much greater distances. We believe
it may be possible to make it work via the
Internet as well.
Only one challenge/response is required
to open and drive the car when the “PIN
to Drive” feature is not enabled in the
vehicle.
One of the attackers does have to be very close to
the victim’s card when the mule is using a smartphone. This distance might change
depending on multiple factors, but a distance of 4
cm or less might be fairly precise when using a
smartphone. Using a more specialised, high power
device might make this distance much bigger. In the following links is possible to read an old paper demonstrating it and also a a link with one of those long range readers that can be hidden in a backpack/purse while performing the attack:
We actually bought this long range antenna and perform some tests to show that more than 10cm can be used to read the victim's card / smartphone. We will use it in future proof of concepts shortly. The following video shows it working while reading an NFC card with more than 10cm distance:
However, 4cm can be enough in some scenarios
when the victim is distracted, like a crowded night
club/disco. If the attacker at the vehicle is ready at
the driver’s door, then contact with the victim’s NFC
card needs to only be for one to two seconds to be
effective.
It is also important to clarify that this attack also works against smartphones that have the NFC capability to open the vehicle. Instead of targeting the Tesla NFC card, the victim's smartphone would be the target.
