Bluetooth Vulnerability - Paak Related

[rockatansky]

Article and research are Tesla focused, but Mach-E Paak uses BLE (please correct if wrong) and is likely impacted.

https://www.autoblog.com/2022/05/17/ncc-group-reveals-bluetooth-hack-tesla-vehicles/

Sponsored

 

[GoGoGadgetMachE]

sounds like the same basic idea as the keyfob relay attack that's been a thing for a while.

Ford's done some theoretical work to try to stop that; I wonder if it would apply here.

Ford Patent Filed For Vehicular Key Fob Relay Attack Prevention System (fordauthority.com)

 

[Logal727]

Article and research are Tesla focused, but Mach-E Paak uses BLE (please correct if wrong) and is likely impacted.

https://www.autoblog.com/2022/05/17/ncc-group-reveals-bluetooth-hack-tesla-vehicles/

This seems to the same exploit that is used for fobs. It basically makes a bridge between the hacker laptop and the BLE phone or fob on the owner

 

[Electric Goat]

Fortunately, my android phone gives me the ability to customize when PAAK is active. I set my PAAK to only activate if I manually open the FordPass app. Good luck hackers. That's one more barrier for them.

 

[JamieGeek]

Odd that the autoblog article says "hundreds of miles away" but the original Reuters article does not.

Given that BLE is a short ranged protocol I wouldn't expect this to work from "hundreds of miles away" without some sort of relay.

 

[JohnFoxeSheets]

Odd that the autoblog article says "hundreds of miles away" but the original Reuters article does not.

Given that BLE is a short ranged protocol I wouldn't expect this to work from "hundreds of miles away" without some sort of relay.

Exactly. In the Technical Advisory their test setup is disclosed, and as you would expect, there needs to be devices in relatively close proximity to both the user's PaaK phone and the car:

"In the test setup, the iPhone was placed on the top floor at the far end of a home, approximately 25 metres away from the vehicle, which was in the garage at ground level. The phone-side relaying device was positioned in a separate room from the iPhone, approximately 7 metres away from the phone. The vehicle-side relaying device was able to unlock the vehicle when within placed within a radius of approximately 3 metres from the vehicle."

So while theoretically the person stealing the car could have an accomplice situated near the owner's phone hundreds of miles away, in practice this is hard to see being practical. Would make for a good James Bond movie, but not likely much else.

That said, I agree that BLE is being used for things beyond its intended purpose.

 

[dtbaker61]

Fortunately, my android phone gives me the ability to customize when PAAK is active. I set my PAAK to only activate if I manually open the FordPass app. Good luck hackers. That's one more barrier for them.

I typically turn off either/both BT and FordPass when I'm not driving.....

 

[GoGoGadgetMachE]

Odd that the autoblog article says "hundreds of miles away" but the original Reuters article does not.

Given that BLE is a short ranged protocol I wouldn't expect this to work from "hundreds of miles away" without some sort of relay.

there is a relay. it's why it's not too different than the keyfob attack ultimately.

 

[newmme]

Can we just set a PIN to drive like this?

PIN to drive

 

[RickMachE]

Can we just set a PIN to drive like this?

PIN to drive

No.

 

[newmme]

Bummer, guess we are vulnerable then.

 

[Polar]

No.

Well - yes.
But it’s a passcode and it’s tied to but separate from PAAK.

So have your door pin and startup passcode working and close out FordPass/Bluetooth on your phone and pin/passcode only car access.

 

[dtbaker61]

Can we just set a PIN to drive like this?

PIN to drive

I suppose you could set up PAAK initially, set your Backup code, and then disable PAAK by deleting the second BT connection that gets set up for your PAAK, and always use the BackupCode after you set it up.... basically a PIN that is stored in the car's computer and has to be entered on screen.

This might also kill ALL the FordPass functionality from your phone, but it would be more secure?!

 

[dtbaker61]

Exactly. In the Technical Advisory their test setup is disclosed, and as you would expect, there needs to be devices in relatively close proximity to both the user's PaaK phone and the car:

"In the test setup, the iPhone was placed on the top floor at the far end of a home, approximately 25 metres away from the vehicle, which was in the garage at ground level. The phone-side relaying device was positioned in a separate room from the iPhone, approximately 7 metres away from the phone. The vehicle-side relaying device was able to unlock the vehicle when within placed within a radius of approximately 3 metres from the vehicle."

So while theoretically the person stealing the car could have an accomplice situated near the owner's phone hundreds of miles away, in practice this is hard to see being practical. Would make for a good James Bond movie, but not likely much else.

That said, I agree that BLE is being used for things beyond its intended purpose.

aha.... so when walking away from the car, it *would* be more secure to either close FordPass, and/or disable BT on your phone.... re-enabling upon approach and while driving.

 

[AllenXS]

No report on how many have actually been stolen, its still a possibility?

Sponsored