In 2020, Tesla informed the US Federal Communications Commission about plans to use ultra-wideband (UWB) technology in its keyless entry systems. This technology was expected to accurately measure the distance between a key fob or smartphone and the car, potentially preventing thefts through relay attacks. Tesla claimed that this distance measurement, based on Time of Flight, would be immune to such attacks. However, GoGoByte researchers recently demonstrated they could still execute a relay attack on the latest Tesla Model 3 using Bluetooth, from as far as 15 feet away, just like with earlier models. While Teslas do use UWB, it appears they don’t use it to prevent keyless entry theft.
When GoGoByte informed Tesla of their findings, Tesla’s product security team clarified that UWB was not yet intended to prevent theft and was still being refined. They stated that UWB ranging would be enforced once its reliability improved. According to security researcher Josep Rodriguez, it’s not surprising that the initial implementation of UWB in vehicles doesn’t yet prevent relay attacks, as finding a balance between security and user experience can take time.
The slow adoption of UWB security features isn’t unique to Tesla. GoGoByte found two other carmakers with UWB-enabled keys still vulnerable to relay attacks, one of which hadn’t even activated the UWB feature in its cars’ locking systems.
Despite their vulnerability to relay attacks, studies show Tesla are less likely to be stolen than other cars, thanks to their default GPS tracking. However, car theft rings still target Tesla, using relay attacks to sell them for parts.
GoGoByte believes Tesla can fix this issue through over-the-air updates, given they have the necessary hardware. Until then, Tesla owners should keep the PIN-to-drive protection active to secure their vehicles.
