Stealing a Tesla and Cloning The Key in Just 2 Minutes

Many people want a Tesla car, including thieves, and it turns out unlocking and stealing a Tesla is easier than we may have previously thought. A vulnerability in Tesla's NFC cards could allow a hacker to register their own key to the car, and a separate bug in Pin2Drive could allow the hacker to drive off with the car even if that multi factor driving security is enabled.
trifinite.org/...
Gone in under 130 Seconds (demonstration of key cloning)
• Gone in under 130 Seconds
₿💰💵💲Help Support the Channel by Donating Crypto💲💵💰₿
Monero
45F2bNHVcRzXVBsvZ5giyvKGAgm6LFhMsjUUVPTEtdgJJ5SNyxzSNUmFSBR5qCCWLpjiUjYMkmZoX9b3cChNjvxR7kvh436
Bitcoin
3MMKHXPQrGHEsmdHaAGD59FWhKFGeUsAxV
Ethereum
0xeA4DA3F9BAb091Eb86921CA6E41712438f4E5079
Litecoin
MBfrxLJMuw26hbVi2MjCVDFkkExz8rYvUF
Dash
Xh9PXPEy5RoLJgFDGYCDjrbXdjshMaYerz
Zcash
t1aWtU5SBpxuUWBSwDKy4gTkT2T1ZwtFvrr
Chainlink
0x0f7f21D267d2C9dbae17fd8c20012eFEA3678F14
Bitcoin Cash
qz2st00dtu9e79zrq5wshsgaxsjw299n7c69th8ryp
Etherum Classic
0xeA641e59913960f578ad39A6B4d02051A5556BfC
USD Coin
0x0B045f743A693b225630862a3464B52fefE79FdB
Subscribe to my KZbin channel goo.gl/9U10Wz
and be sure to click that notification bell so you know when new videos are released.

[@ryguy9876]

Add that to the list of "why the right to repair and ownership is important." Seriously, screw modern security practices.

[@comet.x]

modern 'security' practices piss me off.

[@YeeLeeHaw]

Support EV companies like Aptera that are strongly for Right to Repair.

[@LatvianVideo]

Thats why I want an old car, parts are more available, I can repair it myself, electronics cant be cracked, if there are no electronics (well, some electronics are needed to actually prevent theft)

[@bradhaines3142]

what they call 'security' they actually mean 'the companies financial security'

[@comet.x]

@@bradhaines3142 I dunno man I feel like potential lawsuits aren't very financially secure

[@tux8664]

Thanks bro, as a serial car thief, this will definitely help me in my next high speed chase!

[@pwn-it]

lmao

[@oqocraft2661]

same

[@sleep3017]

I guess your market of expertise is Grand Theft Auto

[@window.location]

Don't forget to tag Elon. 😂

[@josiahfugal5407]

Maybe Tesla owners will think twice about leaving their car in the street overnight now. Information should be free.

[@hipnog8002]

Ah yes, the overpriced car that you don't own even after literally purchasing it has a blatant security flaw? Color me shocked.

[@Jon-ko3vv]

Lol yep

[@Vihktor]

Fedboys need a way to see if you got grass.

[@supertrooper6011]

exactly, can it really be stolen if you never really owned it? - either way you will own nothing and you will be happy (last part optional)

[@duineganainm]

No no it's a good thing you Tesla still owns the car, this way they should be obliged to provide a replacement if it gets stolen due to a blatant security oversight on their part

[@Gigachad-mc5qz]

I wonder do you own other electric cars though? Id like to have one but if its like that i will stick to my 98 corolla

[@pacifico4999]

Time to add a padlock to the car like Mr. Bean

[@antonlencses8622]

Lockpicking lawyer wants to know your location.

[@ryandgarland]

The club! 😁

[@jettlucashayes8508]

No install a kill switch, gps tracker and quick release wheel

[@pikaa-si9ie]

@@jettlucashayes8508 remote self destruct switch

[@davidsatriowibowo5727]

I wish we could use old keys on teslas lol

[@LarkyLuna]

Watching lockpick lawyer has taught me that most lock makers cheap out in locks But the electronic ones are usually the most infuriating Some you hit the reset password button from the outside, or just unlock it using a magnet It's so dumb Why add points of failure to a security device?

[@Societyman123]

bruh nobody "adds" points of failure cmon

[@gleipnirrr]

@@Societyman123 ever heard of a backdoor?

[@Societyman123]

@@gleipnirrr words words

[@elijahnierstheimer9674]

@@Societyman123 learn to use them

[@Societyman123]

@@elijahnierstheimer9674 granted, it's hard

[@skwisgaarskwigelf331]

The more I know about technology, the less I trust it.

[@MentalOutlaw]

But Skwisgaar doesn't even have a license?

[@ozenthelewdable5427]

The more I know about technology, the more I want to return to monke.

[@grieveinsilence]

The only kind of people who likes "Smart something" is people who are tech illiterates

[@mettatonneoex]

Advance to open source

[@skwisgaarskwigelf331]

@@MentalOutlaw I finally gots them loicense from Mr Gojiras. I beateds Toki, as always.

[@johnsmith8981]

It blows my mind how many companies and manufacturers of security devices use NFC or RFID with no/weak encryption. I was easily able to clone my badge for work it would be so trivial to gain access even if you couldn't clone because we have doors with some easily picked locks right out of camera range. Ever since I started getting into physical security I can't stop seeing how bad it is at most places.

[@madthumbs1564]

Businesses that have government contracts in the US have to have security. -It doesn't mean they need it. It could be a glue factory for example.

[@chillappreciator885]

Hey man, are you sure you are thinking in the right direction at work?)

[@astroorbis]

I've done some badge cloning myself to make sure I have a copy if I ever lose mine, but how would you get access if you couldn't clone a card? Copy someone else's card when they tap? Some kind of playback chip?

[@user-xl5kd6il6c]

NFC is shit for security But I find it funny that people waste time in specific scenarios against tesla, where in most places, the physical security is even worse, and would take even less effort to get in

[@scienceface8884]

For most locks, it's not about being impenetrable. It's about being inconvenient enough that most people won't try. If you plan ahead, acquire just a little bit of know-how and come prepared, you can bypass the vast majority of security without much issue. You'll also be easy to arrest if the police check you, which is why the majority of thieves I've ever come across just check to see if the door is unlocked or can be bypassed with a coat hanger, library card or butter knife.

[@matejkohout1289]

LMAO imagine that super futuristic electro vehicle is less secure then car from 1998

[@thetechfromheaven]

Now I don't feel so scared of getting my Honda shitbox stolen 😆

[@jacksonburger2081]

How many times have you heard of a Tesla being stolen?

[@popopop984]

@@jacksonburger2081 How many people buy Teslas?

[@jacksonburger2081]

@@popopop984 Online reports say ~2.5 million vehicles.

[@Qvartz_Lite]

Ever since the videogame Watchdogs was released, I knew that the hacking depicted there was hypersimplified and there was no way that we could steal vehicles with Smartphones... I stand here corrected

[@tablettablete186]

Impossible right... *Tesla getting hacked intensifies*

[@voxelfusion9894]

Standing here, you realize.

[@heroslippy6666]

A lot of work went into figuring out these attacks, but once all the heavy lifting is done you just gotta distribute an app.

[@snikrepak]

When Arron Shwartz made that ATM spit out all of its cash with a phone, I knew then and there there is no security.

[@nothanks5531]

tech ceos have a fetish for tech dystopias they probably made the security bad on purpose so they could soyface and say "omg real life watch dog"

[@DDVgamingpros]

Being able to open the car is bad enough. Being able to bypass the security and take control and drive off with the car as a random is terrible. If you played Watchdogs this is literally something a hacker/script kiddie could do. get into any smart vehicle, bypass any security checks/locks, and drive off with the car without making a scene ie no alarms/law enforcement to stop you.

[@InteloPL]

Security guys tried to warn you, folks. And politicians weaponized it in their fight against thr right to repair...

[@davidsatriowibowo5727]

yep

[@arandomcommenter412]

Wow watchdogs is getting a real life edition??

[@ihurtyourbrain3685]

You shouldn't compare video game logic to real life.....

[@wolfesbane4263]

Ahh yes, so its possible to basically play Watch Dogs irl.........colour me impressed

[@mattynotfatty]

Teslas are a load of shit; awful for the environment, cost way too much money, don’t last very long, awful security and anti-consumer.

[@ddude27]

Jesus what a huge ass fail. Although honestly car security has gone down hill incredibly fast because it isn't seen as a huge thing for common property for cars...

[@cherubin7th]

Yes seriously, good architecture design would make such issues almost impossible.

[@blu3_enjoy]

Car security go down because big brother get more eyes

[@ko-Daegu]

it didn't go down but rather can't keep up with new features

[@ddude27]

@@ko-Daegu I doubt that as it's more of the line of thinking that business people wanting to release something before it has proper quality checks on it. We can push in all the features we like but quality suffers dramatically all in the name of profit. Security should be a big thing but living in 2022 more and more hacks are happening because companies just don't seem to care until it's too late.

[@jettlucashayes8508]

Just install a kill switch

[@KRawatXP2003]

Just like smartphones! 🤓

[@gamerkev30]

This is what happens when companies think that they can have you buy their product and still keep thier own product. If this becomes an industry standard, it will be normal for people to hack whatever they buy lol

[@45Thunderbird]

Tis true, challengers and mustangs have aftermarket devices and 3rd party technicians (usually at dyno shops) that let you open up all the performance pages and ecm functions right from the console mfd that might not otherwise been sold on that vehicles trim level..but its still installed and locked away

[@WilliamWatrous]

reminds me of early iphone where people would jailbreak

[@ryandgarland]

Actually this type of security is industry standard.

[@scottgreen3703]

This happening now with windows 11 you don't own it

[@fresanegra77]

As you make your way onto your cell you hear your cellmate asking "what'd ya do to get in here?" And with all your bravery and shame you answer "I hacked my milk to drink it straight from the carton".

[@birb2726]

at the starting the supposed "attacker" had to be in real close contact with the nfc chip of the door since nfc by design has a really short range overlooking the fact that such thing would never be missed by the most basic of the security engineers .

[@brylythhighlights4335]

Once upon a time you could install a hidden kill switch in your car with a bit of light wiring. Now your car will throw a temper tantrum if you get your tires changed at the wrong garage.

[@scrittle]

It's like having your very own personal Elon Musk

[@muchozolf]

I'm curious why'd you need a kill switch in a car and how it would work.

[@brylythhighlights4335]

@@muchozolf If you have a hidden kill switch, your car is immediately much harder to steal, because without flipping it, the car won't start. As for how it would work, I'm not sure I can do a good explanation, but this video kzbin.info/www/bejne/jobLiX-pp7-ce5I gives a quite good idea!

[@muchozolf]

@@brylythhighlights4335 Oh! And now I remember I've heard about it somewhere. My dumbass brain figured that it would be useless to have a kill switch as you wouldn't be there to switch it when your car is getting stolen. Smh.

[@adrianalexandrov7730]

I've seen such kill switches installed by the owners: you break circuit with magnet sensor they still use for regular doors in the building, and you hide that somewhere under the plastic of you front panel or in the glove compartment. Now you need to put some magnet near that area and the car could be started with the key. Without the magnet in the right place - it's just dead. That's how my old man secured his car in late Soviet Union.

[@killgaet6253]

saddly, here in Europe we can't secure our cars by having a manual car since everyone know how to drive manual here.

[@nukiradio]

There has to be some irony in both wanting manual gear shift, and self driving cars at the same time

[@killgaet6253]

@@nukiradio i don't want self driving car, i like driving manual.

[@howtomundane3109]

In Europe it is not even a rarity to see cars with an automatic gearbox that you can shift manually as well. So even the opposite won't work.

[@BillAnt]

In Europe you should get an automatic instead to confuse the manual driver. lol

[@killgaet6253]

@@BillAnt we drive both tho.

[@45Thunderbird]

So I sort of have an idea that I think could maybe help out.... what if instead of keyfobs and signals, we used physical keys that we use on the front doors to a house, but like, on our cars? Sure you can still get through a front door eventually, but atleast you have to expend effort in looking like your trying to break in and not like your the owner to neighbors at a glance. Idunno, just an idea, im not an automotive engineer or marketing exec.

[@SteveMacSticky]

@45Thunderbird yeah, I know. They are so dumb

[@H3LPIV3FALL3N]

Just put a lock on it like normal cars😂 that is the perfect idea

[@H3LPIV3FALL3N]

@don't be surprised that is a suspicious link homie

[@Wampa842]

Are you serious? What's next, no vulnerable computers? No manufacturer backdoors? No proprietary software? OWNERSHIP OF YOUR PROPERTY? What are ya, nuts?

[@Gigachad-mc5qz]

@@Wampa842 no computer is 100% invulnerabke but i get what you mean. I dont want a loading dock like windows has

[@MrCool-lo3ls]

As much as i feel insecure when watching the lockpicking lawyer, i feel much more insecure, when watching companies use tech for security. I respect the fact that any circuit is hackable and can fail. I feel much safer, when dealing with mechanical appliances.

[@SamTheEnglishTeacher]

You know what can't be hacked? That's right, a good guy with a gun.

[@hedgehogdinosaur3023]

@@SamTheEnglishTeacher Except for the brain worms.

[@tux_the_astronaut]

tech cant rly beat mechanical sense tech just has WAY more points of failure

[@comet.x]

only if it's online. not much you can do to an offline system without physically accessing it. And at that point it's just as secure as a normal lock

[@jannikheidemann3805]

@@SamTheEnglishTeacher The guy with the gun has to be able to see. He can not do so if he is blinded by invisible lasers.

[@-.....-.....-..............-]

this is some watch dogs tier shit

[@jacobthesomething]

@1min ago never understood why these show up here theres no reetrdod 10 yr olds

[@ihakker1416]

the stick-shift thing is only valid in the USA though, in Europe (almost) everyone knows how to drive a manual

[@ineligible2267]

Yeah where I live I'd say 99% of people learn to drive manual

[@OCtheG]

@@ineligible2267 I know a single person who’s ever even been inside a stick shift, they’re unicorns in the states.

[@vincei4252]

@@OCtheG I'm European and I've lived in the states for 25 years and I've only ever bought stick shift cars. My ex who's an American also only buys stick shifts - she has a stick shift BMW at the moment. All the mechanics at the repair shop that I use down the road drive stick shift cars. I guess it depends on who you hang out with :-)

[@vincentschumann937]

had someone drive a company automatic and shift multiple time bc the person never drove an automatic before

[@YerBrwnDogAteMyRabit]

@@OCtheG Is his name Ant Man?

[@Reth_Hard]

Just make sure there is no guys with a black hoodie near your Tesla when you unlock it, that's pretty simple...

[@ryandgarland]

Most people aren't criminals. It is better to live in a good area than anything else. I don't hear about Tesla's getting stolen.

[@RusherDevelopment]

The Apple of cars

[@ReddRubble]

Until Apple makes their own cars

[@aquavitae3824]

Oof, so accurate

[@chubbycatfish4573]

That came to mind as I watched, too.

[@YeeLeeHaw]

@@ReddRubble Where are they? I've heard this argument ever since I first found out about Tesla back in around 2012 and every "Tesla Killer" has disappeared as fast as they showed up. If any company is going to compete it's probably going to be a company like Aptera that offers something completely different with its frugal design that rich mega companies cannot comprehend, but even there it's so hard to get into the mass production phase that I will be surprised if they succeed.

[@thatoneocto]

Rusher dev!!

[@jacoblessard8213]

To be fair, this is actually quite a lot easier of hack technically than anything a "script kiddie on cOlLiE Linux" would be struggling with. It just requires balls. If someone body wanted to do this, the could have 1/4 the knowledge I do in cyber security and probably still find a way to pull it off.

[@Spheredalai]

fun fact, a manual transmission electric car does exist back in the 80s, and it has, A NORMAL PHISICAL KEY!

[@zydiz]

multi-speed transmissions (auto or manual) in general don't make sense with electric motor due to the fact how they work.

[@Spheredalai]

@teeveefy modern CVT automatic cars did this nowadays, it just has 1 gear powerband but the ECU tricks u into thinking that it has more gears by doing "fake" shifting, u should find that normal by now, but yea i think there are no electric cars that did this nowadays it's just as boring as put it in gear and go

[@imchris5000]

@@zydiz they do though even electric motors have peak efficient rpm just because it can do it does not mean its the best. porsche uses a 2 speed gear box on the taycan.

[@joeycommet45]

"Hotwiring is a thing in the past. Now introducing key cloning! Welcome to our dystopian world of tomorrow!"

[@mikeselectricstuff]

Nothing inherently wrong with NFC if implemented properly.

[@peanutbutterpadre1519]

Mental outlaw seems to be more desperate for clicks with this one maybe next he will tell us how easy is it to steal an f150.

[@oceanlawnlove8109]

Idk this but maaaaybe there's another way to wirelessly unlock your car that's just a lot smarter to use from the ground up, without even having to work super hard to implement it in a safe way? Maybe that's what he's tryna say

[@ghosthunter0950]

​@@peanutbutterpadre1519 Wym desperate for clicks? He literally showed the security flaw he was talking about.

[@da-voodoo-shuffle]

I think the 130 sec registration is the problem. It's how you handle the handshake at each end. Don't we use tap and go from our phones.

[@fareskazemi2841]

He probably just bought a Tesla hence the delusional denial lol

[@ericcarabetta1161]

My favorite thing that the Autopilot does is to disengage right before an accident so that they can claim it's the driver's responsibility.

[@aeiou0858]

Bruh

[@mike4402]

ancap moment

[@certifiedpossum1638]

Finally, the solution to the trolley problem /s

[@Bmw1000c]

Technically a L2 driver assistance is always the driver’s responsibility, by design.

[@testacals]

lmao

[@Ypog_UA]

"Buy our car if you want to save the environment! No emissions!" "What do you mean you want our cars to be usable for more than one purchase? Just dump it in the ocean and buy the new model." I like how big tech sells every product like a smartphone, even cars...

[@jacksonburger2081]

Nobody's ever said that. Tesla's are made to be driven 500,000 miles, compared to the gas cars that break after their warranty expires. There's one guy who's already driven ~450,000 miles.

[@Ypog_UA]

@@jacksonburger2081 It's not about gas vs electric, it's about sustainability. Preventing or discouraging car re-selling only creates more waste.

[@COLT6940]

@@jacksonburger2081 reddoit never own a car.

[@jacksonburger2081]

@@Ypog_UA He did put the comment on a Tesla video🤷🏼‍♂️ But you're right. It's all automakers at this point.

[@jacksonburger2081]

@@COLT6940 What do you mean?

[@liamholcroft7212]

anyone stealing a tesla is doing the owner a favour

[@SteveMacSticky]

😂👍

[@RC-fp1tl]

>drives shitbox

[@liamholcroft7212]

@@RC-fp1tl shit box over a Tesla any day

[@SteveMacSticky]

@@liamholcroft7212 I hear that

[@soooslaaal8204]

@@RC-fp1tl 1999 Honda Civics are better than any Tesla

[@Woodywoodah]

I was pretty disappointed to discover that I need an in app purchase to enable the rear seat heaters in my Tesla Model 3. I feel like that one doesn't get talked about enough because people are so focused on the full self driving thing.

[@jonmichaelgalindo]

You can root and hack your Tesla to enable whatever you want. You lose warranty and future updates. What's worth it to you?

[@Woodywoodah]

@@jonmichaelgalindo once the warranty is over I plan to go nuts. Get root. Unlock all the things. Disable traction control for unofficial “track mode” etc.

[@chessai2121]

What year? I have a 2019, and didn't need to do this.

[@dabert5972]

@@Woodywoodah idk about future models, but you can disconnect the cable for TC and ABS physically. It's up in the front-left tire well. No other mods/hacks needed. They drift really well too! The thing is a cheat code at car meets

[@VitalTechnology_]

That's just another reason to dislike Tesla. They restrict features by software hidden behind paywalls, have no real security and that includes their ai driving. Even though gas prices are insane, they could triple from what they are now and statistically speaking you would still save more money in your lifetime of driving than buying a tesla. Not to mention that naturally aspired vehicles do less harm to the environment. Edit: the reason why teslas are more harmful to the environment than driving a gas powered vehicle (and I'm pretty sure that goes for diesel as well) is because of how they're created and disposed of. Those lithium batteries pack a punch and currently we cannot dispose of them properly. What we call "properly" is not ethical.

[@InfamousKicker]

Ahh yes ford and gm. The companies that definitely do more for you

[@TheSuperBoyProject]

Just buy an old volvo and do engine and transmission swaps everytime one goes out.

[@totallynotbluu]

@@InfamousKicker Ford actually sells parts to it's consumers and even encourages it. Hell they're selling the motors for the Mustang Mach-E and allowing them to be swapped into old cars.

[@444455555ization]

You're right. Our only path forward is high quality public transit

[@reilysmith5187]

The software paywall is simply to differentiate between consumers. If they didn't they couldn't sell their car to less rich buyers.

[@somnion5094]

When you were talking about locks I was thinking about the Lock Picking Lawyer and how he disagrees. Then you said about "the malicious adversary needs to be there" and you suddenly made much MUCH more sense. Excellent video as always.

[@TROY-MCCLURE-1991]

The best Tesla prank ever!

[@hn1f]

STEALING MY GIRLFRIEND FRIEND'S TESLA PRANK (FUNNY) (GONE WRONG)

[@DoublesC]

I was not expenting a lot from tesla security but I am still impressed they have this level of bad security.

[@jettlucashayes8508]

@ㄥㄚҠҠㄖ丂 nah manual + kill switch, that or buy a Supra since you can do whatever the fuck you want with it while maintaining your warranty

[@michaellin4553]

@1min ago **NO**

[@S3nt1nel]

The worst part of this is you'll never hear someone driving off with your tesla. Could be gone overnight in a different state by the time you realize it. All the big v8s in my driveway will let me know they're going somewhere

[@MisterMosfet]

My poorly mounted exhaust that sounds like a cowbell saved my ass once before, can't mistake the sound of a hooptie rolling down a driveway

[@ZÏ̇̃]

Atleast you can track your tesla with the gps in the app 🤷‍♂️

[@hungaro7964]

there will be just parts not Tesla by the time you realize it

[@raute2687]

EVs are like smart-TVs; they sound really good at first, but then you realize that half the price is just for useless shit you didn't ask for. I want a dumb car and a dumb 4k TV, without networking capability (except maybe the car radio), without spyware, without remote access for the manufacturer.

[@WesternHypernormalization]

Preach!

[@cowthedestroyer]

Ive got the best type of theft protection. A 4 speed manual that you start out in second gear

[@BeHappyTo]

wdym about starting in second gear part?

[@cowthedestroyer]

@@BeHappyTo first gear is 6.62:1 unsynchronized you can start in first gear fine but it's hard to shift out you are slow and second you just slip the clutch a bit and you are good. Np 435 dodge variant

[@silverchairx]

Who remembers when Kenny titled one of his videos "Wealthiest African American tries to buy bird". I might be paraphrasing but it cracked me up.

[@cubimon8219]

As someone from Germany who still drives a manual car, like many others do here, I feel a bit offended, but it is still funny

[@elliottanderson9507]

do you wear a "industrial meme" shirt and cargo pants/shorts XD

[@namesurname4666]

same in italy

[@yourmum69_420]

@bruh because it's better

[@yourmum69_420]

@@neighbor472 you have more control over the car

[@czechvirusS]

@@neighbor472 i'd also say that the advantage is more control. You also feel more connected to the car. And its much harder to doze off when you have to manhandle a shaft the entire time xD

[@7heMech]

Well... That was certainly unexpected.

[@oz_jones]

Was it though?

[@haydenwolfe7846]

I always liked the Talladega Nights variety of securing your car: just put a Puma in the passenger seat

[@youdontneedmyrealname]

Sounds like something that was used in debug mode/development phases of the tesla that were not turned off in production firmware.

[@99monsters12]

The fact that you don't even have twitter makes me respect you more

[@Mattew64Games]

In Europe stick are the most common, it's rare to see automatics even tho they tend to become more and more popular

[@TadanoHitohito]

There's a positive correlation between knowing how to drive stick and having a good relationship with your father.

[@yeahgirl11]

Lmfao

[@soooslaaal8204]

REAL

[@ashishpatel350]

The scary thing is Tesla's are more secure than other oems. The hilarious thing would be if they can activate summon feature and just drive the car from their device

[@DeeezNuts]

well you kinda can since there's a jailbreak for it if im not wrong, but its paid and probably like apple if you do it they take your warranty and maybe worse

[@omt4873]

GTA in real life

[@Iswimandrun]

Bowley Rotasera lock is my favorite physical key. Combine that with a device that can do FIDO2 with ed25519-sk and make the physical key the connector that does the data transfer then presto my dream security. Obviously have a USB-C connector also to let you use the device as a security key for web accounts as well.

[@talktothehand1212]

How do you register the pubkey of the FIDO2 device though? For web accounts and ssh keys, FIDO2 is absolutely the way to go. But how do you pair keys to the physical device in a way that can't be exploited?

[@Iswimandrun]

​@@talktothehand1212 well assuming in this dream car security situation the operating system would be based off FreeRTOS and would be open source. There would be a way to dump the OS/Firmware and preform a hash to verify authenticity of the software that's running the hash would change once a public key is registered though it wouldn't count the public key in the hash. The public key wouldn't get dumped with the firmware just a variable that is set to the number of registered public keys. This would allow for predictable hashes you would just take the regular firm ware from github and iterate the variable that denotes number of public keys registered upwards tell the hash matches. If you get past the number 3 for that variable and the hash doesn't match then hope a re flash of the software fixes the issue this wouldn't clear the public key memory. The physical key would have a set of numbers denoting it's physical dimensions. The manufacturer/seller would have a copy of those numbers also as they made that key. Before purchase the car would be in a lower security state and would only rely on the physical keys dimensions for operation. The key would need to be initialized maybe like a Trezor or Ledger hardware wallet so your backup of your digital key would be 24 word passphrase keep that safe incase of lose of key along with the numbers that denote the physical dimensions. Then you would need to generate your public and private key pair which would be repeatable given the passphrase to a new blank key. Both would be stored on the key though the private key would be none retrievable and would only be used to verify identity using an ASIC like a TPM 2.0 module. Then the the initial setup procedure after purchase could take place. This would be an operation that would only allow access to the digital public key of the key. After a public key is registered the only way to register another key with a different private key would be to have the registered key in the door and the new key in the other door obviously it would need to have exact physical dimensions as the other and someone in the driver's seat playing with the console to trigger the registration. The one attack that could work to circumvent this procedure would be to take apart the car and try to glitch the processor that preforms the is public key registered yet check at just the right time maybe by shocking it to trigger the registration of new key protocol. The protocol used to pass messages from car to key would be over SPI or UART. There would be a way to wipe all registered public keys to the device but you would need a least one registered public key to do it. This would allow for reselling of the car and reinitialization of the passphrase of the key. Also the physical key and physical lock should be designed in such a way that it would only provide power to the key if the physical lock is a match to the key. Now for remote unlock cause not everyone wants to put things in holes. Once the public key is registered the communication over radio can take place powered by peezo electric buttons that generate energy via crystal deformation kind of like a Philips Hue light switch only able to do Diffie Hellman key exchange using ed25519.

[@skel9242]

how the fuck did NFC car keys make it past brainstorming, let alone production, let alone with the 130 second timer that must have been arbitrarily put there by someone because there's no way a bug makes a key literally useless for 2 whole minutes we live in a simulation, this has to be intentional to some extent.

[@skel9242]

also does this mean you can actually use an amiibo to steal a tesla??????

[@op-op-op]

@@skel9242 all cars that use key chips can be hacked much easier

[@cherubin7th]

We need open source electric cars.

[@Ken-S]

Comma?

[@mahirdeth]

no we need more machine than computer in a car

[@talktothehand1212]

@@mahirdeth open hardware is a thing

[@tux_the_astronaut]

I think we just need to make them more mechanical again. I have a jeep and the only thing the computer in it dose it play music and radio everything else is all mechanical and thats how i think it should be

[@talktothehand1212]

@@tux_the_astronaut how old of a jeep are we talking here? Assuming something within the last 20 years, you realize the ECU (basically a computer) has a ton of control over how the engine works right?

[@slavsquatsuperstar]

It’s not a design flaw; it’s a feature.

[@dymoslaw]

Lockpick lawyer would unlock it in a blink of an eye With peanut butter jar

[@supermasterfighter]

With rock 🪨

[@NoorquackerInd]

Hey Mental Outlaw, good video and all, but NFC itself isn't inherently secure. Yes, your run-of-the-mill NFC card is unencrypted, all it does is act as crappy storage that anything can read and write to, in plain text. But there are encrypted versions, like the NXP MiFare DESFire chips that use encryption and have keys programmed into them from the factory. Yes, it's absolutely proprietary, but it's better than unencrypted nonsense. If your threat model is a car thief, it's good enough, but don't expect it to stop governments.

[@adamblomberg]

All credit cards, mobile NFC pay and digital keys use NFC. You can't just copy them digitally and use them as if you had them physically, then everyone would do that. I researched this when I wanted to copy my hotel NFC key but it's not possible.

[@matejkohout1289]

Yeah but does tesla use it? No.

[@aviewer6299]

Relay attacks exist on any car FOB, not just NFC based ones. I don’t like Teslas because it’s still a car which causes more issues than it solves when it comes to transit (the whole underground highway thing is laughable), but they aren’t less secure than other cars

[@NoorquackerInd]

@@adamblomberg Yeah, this was the point I was trying to make. There is no problem with using NFC alone, the problem lies in how people implement it. NXP MIFARE DESFire cards are NFC-based and are proprietary, but hey, they're tried and true

[@collin491]

Elon is not some genius he just got in PayPal early with a bunch of other people, and sold his portion for a ton of money and along with his family's money he made this image of a tech guru who can do no wrong.

[@YeeLeeHaw]

Well, let's not go too far. The man made Tesla and SpaceX, started the EV revolution, and when you listen to him talk about the technical aspects it's obvious he knows a lot about his companies and products. Maybe not a genius, but definitely have earned a lot of the praise; the man is passionate about his goals to improve the world.

[@insufferablered6280]

About 0:23 . It's not widely known but Teslas are 11 times less likely to catch fire compared to ICE vehicles.

[@LolJolk]

Thank you I will proceed this tutorial with caution

[@lowwastehighmelanin]

This is actually hilarious. I contracted as support for the fruit company and any time there was a phone update? Tesla and BMW owners would call and yell because they couldn't get their cars working. First of all, you're the one who spent all that money on a depreciating asset, my guy, so focus on why you did that and make better choices. Secondly, It's a rolling computer, it's hackable. Get a normal engine vehicle with diesel and make your own biodiesel if you're worried about the environment. I find this whole thing hilarious and sad because people continue to prove that money cannot buy you good sense. 😂😂😂

[@senseal5462]

first it was handles pull handles on the inside of the car so if the electrical system fails because the battery is on fire. you are stuck inside the car. now people can just open your car very easily because keys no longer exist

[@DarkGT]

In Tesla's defense, the poor security of cars is common practice. So common to say is industry standard to be so bad.

[@slay3rgamingyt]

True, my lil bro did a stupid thing last week by leaving behind keys in boot of our 2014 Toyota Etios and all I had to do to open it was putting a screwdriver in a specific position to open the boot. I was like damn, this is so fuckin easy it's kind of concerning

[@apreviousseagle836]

Is it really 1 out of 10k people that can drive a manual transmission? wow

[@supermasterfighter]

There’s no way that’s accurate, more people probably know how to drive a manual transmission than that, it’s not THAT HARD for god’s sake.

[@nomore-constipation]

Had a ’68 Nova where it was automatic but we installed a stickshift in between the two sides to make it look like it was a standard vehicle. It was amazing how many people didn't even consider asking to drive it. 😄

[@NSPlayer]

Reverse electric truck with Faraday cage Infront of a tesla, open up door, use this exploit and drive into truck, drive to location drop off point and then strip tesla down, rip out computer/tracker then use a thinkpad instead

[@DeeezNuts]

Wont glowies follow you with their space eyes

[@NSPlayer]

@@DeeezNuts terry a davis protects me

[@lvmlvm1729]

It is a simple strategy: 1. Make the car easy to steal 2. Implement iPhone style anty-theft where the car can be bricked remotely, and every part has a serial which must be paired with the computer, so chop shops are out of business 3. If your Testla's windshield breaks, you pay half the price of new Tesla to authorized repair who can pair the new windshield with the car. 4. Profit.

[@zepar6076]

No wonder it has all the hype

[@havarhen]

That manual transmission vs automatic transmission joke is only true to the US, manual transmission is much more common in the europe, and probably the rest of the world.

[@Mechaneer]

You're telling me I'm one in 10,000 in America by knowing how to drive stick? I don't think so bro. I'd guess more like one in 150. And for people who know and use similar shifting technology like say a motorcycle, it wouldn't be hard to figure out.

[@liquidkameleon]

Considering how shoddy their security is, has anyone been able to jailbreak more recent tesla cars? I like how they drive, but I sure as hell am not buying a car that spies on me.

[@snikrepak]

Says the person using a device that does it while they poop...

[@liquidkameleon]

Precisely the reason I'm using a custom rom degoogled phone with adblock and only use my google account for youtube.

[@stevenk7965]

Last week, Warren Buffett talked in BBC news about how investors and traders can make millions through Crypto. He also recommended an expert Mr Dave Javens.Wondering if any viewers here are familiar with hIs services.

[@shawnhopkins2496]

It’s strange how people talk about all the profits, they have been making through trading of crypto, while am here making huge losses. Please can someone put me through on the right path or at least advise me on what strategy to follow.

[@aaronhdallen6971]

Investing or trading with an expert is the best strategy for newbies and busy investors who have little or no time to monitor their trades.... I will advice you to stop trading on your own it’s very risky. Seek advice of a professional trader.

[@ciaraadams2478]

I'm honestly surprised that this name Mr Dave Javens being mentioned here, I stumbled upon one of he clients testimony last week in CNBC news, he seem to be doing extremely well

[@jonassturluson5273]

Yes I use his services, After watching so many KZbin tutorial videos about forex trade, I was still making losses until he started managing my investments now I'm making great profit weekly

[@charlesthomas2735]

I've blown account on different trading platforms for the last couple of months. I will like to see an experienced trader oversee my investments. Any contact details on how to further reach out to him for assistance?

[@elsombero1747]

Better buy a old car and do a EV conversion than buying the "mainstream" solution.. That's why I'm currently working on building my own "Tesla".. It's cheaper, easier to repair, parts can be bought from any car parts store and if I sell it, the manufacturer (in my case VW), won't be able to deactivate all the features unless they know my root password and have someone who knows how to install malware on Arch that's not even running on a x64 platform. As the base, I took a totaled Golf 4 r32 which was declared as totaled because of the missing catalytic converter that got stolen. I paid like 100$ for it, the car is in perfect condition. As the computing unit, I'm using a Raspberry Pi 4 (8gb RAM) with a chinese 13 inch touchscreen display which allows me to control my A/C, heater, ventilation and shows me stuff like temperatures, charge level and how fast the battery is charging and I already did a test drive with it but only with five (used) 16-wheeler lead batteries. Yes, the Pi is running "Btw. I use Arch" distro. The Golf has a manual transmission and I hired a freelancer to build me a adapter which allows me to keep the transmission and the clutch assembly. It works but currently I'm dealing with some small problems with the electronics since the dashboard doesn't work but I'm thinking about some alternative solution which would be proprietary but at least doesn't run Windows, MacOS and it doesn't connect to the Internet.

[@mountain_watcher_8730]

If you buy something, it should be yours, and absolutely yours. The manufacturer should never have the ability to force an update or take away any feature or control you have over it, because you paid your money. If you want to modify it, you should also have that right.

[@jonmichaelgalindo]

You're saying copyright is morally wrong. Are you sure about that? Copyright is the idea that whoever created a thing still "owns" something about it. That your rights as a purchaser are limited. Is that inherently wrong? Does the artist who painted something have a right to control what you, who bought the painting, do with it? (All of these manufacturers' software is protected by the DMCA, Digital Millennium Copyright Act.)

[@mountain_watcher_8730]

@@jonmichaelgalindo Oh no, copyright as an idea makes sense. You need to discourage people from copying your work and profiting from it. What I meant to say was, when you buy something, you should have absolute ownership over that copy of the software or product, not the copyrights to it. You should be allowed to modify or copy software for your own personal use, but not redistribute it for the purposes of making money. Sorry, I should have clarified.

[@jonmichaelgalindo]

@@mountain_watcher_8730 Copyright was never about copying. It's about profit. (That's why there's also patents and trademarks.) A creator has the right to control your (the buyer's) behavior in order to make more money. Here's the question: Is that wrong?

[@mountain_watcher_8730]

@@jonmichaelgalindo I think that the creator has the right to seek recourse if they believe you are unfairly profiting from their work. But they should not have the right to prevent you from modifying a copy of their software that you purchased from them, and more generally, do what you want with it.

[@jonmichaelgalindo]

@@mountain_watcher_8730 That's not an answer at all. It just drops the entire question into the word "unfairly". What _exactly_ is right and wrong when it comes to the creator controlling the buyer's behavior? Modern software is too complex for one human to modify. It takes a team. (I've been coding since middle school, and I'm very good at it, but this is _millions_ of lines of code.) And teams have to share (distribute) their work. And they can run Patreons, get paid subscribers, collect donations, etc. They're putting in hard work. But they're only making money because of the creator's work, and the creator isn't getting anything back. What's the logic here?

[@ItsJynxWorldTv]

WELL IT TAKES LONG TIME TO GET EVERYTHING TO WORK BY THAT TIME I WOULD OF BEEN SHOWED UP AND BLOW A HOLE IN DUDE CHEST

[@sullivann]

The thing is the guy who coped your key could be up to 500 feet away as nfc range works that far

[@ItsJynxWorldTv]

@@sullivann i always have pin to drive on and i can see my cameras live from the app so they wont be going nowhere even with a copy of a key

[@mrED123]

7:02 YEAH! And you can open the trunk! Where you think you store your valuables: by lifting the back row’s seat down! What jokes these cars are, no wonder TSLA dropped 50% from 6 months ago

[@yeahgirl11]

Lmfao are you serious!? 🤣🤣🤣 What the actual fuck?

[@diyanzlatev]

can you do an update video on stealing a tesla? Your sources seem to be from 3 years ago. From a brief search, tesla seems to have made at least 30 software updates for that period. I would be curious to find out if anything has changed. Thank you.

[@1Snouser]

Yea but who would steal a Tesla? The most tracked and documented car on the roads? They would find it pretty quickly lmao

[@tommybahamax]

And there is no "later that day", GPS has already tracked the car and is always tracking the car, cops would have been there LONG before later in the day... so ridiculous

[@Reeces_Pieces]

Comma AI OpenPilot is a more open alternative to Tesla's AutoPilot.

[@4.0.4]

Plus the guy from Comma AI is nice, forgot his name but he has an interview with Lex Fridman about the tech.

[@coomer8265]

​@@4.0.4 i pick Goerge Hotz over elon musk every time

[@kwt195edits6]

i believe all new cars shall implement biometric authentication like a fingerprint for car ignition, just like new flagship phones. it isn't hard, even toyota has implemented it on new land cruiser LC300.

[@rejvaik00]

I am not surprised Tesla is trying really hard to be anti right to repair and the ability to service your own vehicle so I'm not surprised they try to force people out and not find blatant security flaws

[@Mariuspersem]

A guy I know actually got his tesla stolen recently this way

[@bigsyrup8567]

Mock him ceaselessly for being a greasy Tesloid.

[@ILFforever]

Did he get the car back? I'm pretty sure Tesla's could be tracked using the app unless they disassemble and take out the sim card.

[@chefinwhitecoat]

Actually this is a car share feature, soon Tesla will overtake turo and Zipcar

[@EpicBenjo]

Tesla can’t be stolen. Even if you clone the key, they have GPS built in. And to shut off GPS you have to put in a password. They also have PIN to drive for extra security.

[@eli_chaps]

Him: NFC Me: oh shit Now I can finally steal my neighbors Tesla 😂 Good Lord what will it cost you to drive a goddamn car without autopilot

[@sabsajosubjeckt]

Interviewer: Where do you see yourself in 10 years? Me: 12:42

[@jarjarbinks6018]

I don’t have anything against people who drive electric cars but I really don’t want gas cars to be regulated into obscurity. Even now manuals are rare to see but if the only cars that can be sold are EV in the next 10-15 years that will simply mean the phasing out of manuals in their entirety. As someone who likes driving a manual car I don’t really want these types of cars to just disappear

[@yourmum69_420]

same

[@zepar6076]

Indeed

[@misterjib]

pretty much every driver in the UK can drive stick shift, historically automatics have been way less prolific here

[@Osama-Bon-Jovi-01]

True

[@Osama-Bon-Jovi-01]

Tbh I've only once seen an automatic car here

[@misterjib]

@@Osama-Bon-Jovi-01 my mom has one now, because she's 76 and feels she shouldn't have to change her own gears at this time of her life 🤣

[@nexusyang4832]

Tesla is like EA and the car is like their games: endless amounts of DLCs.

[@mateusvmv]

Can anyone explain how Tesla managed to fail in authentication? I thought asymmetric encryption was a solved problem.

[@michaellin4553]

Trust. You have a car, and the car needs to know which keys are the ones to accept. Once a key is registered, it can't be faked/forged, since the signature algorithm works perfectly. However, it only guarantees that a signature is valid and came from a specific public key, not that it comes from a trustworthy party. The proper solution is to hardcode a Tesla public key into all cars, and have Tesla certify new keys. If the car finds a new key, it checks if there is a Tesla certificate that allows that key to be used with the vehicle. Otherwise, some random guy with a random Tesla key can just open every Tesla in existence with that one key. It's called PKI, and you can find it in everything from secure websites, credit cards, and modern passports. The actual implementation is a bit more complicated (certificate authority hierarchies), but the underlying concept has been around for decades.

[@DeathByFilmStudios]

Man, it's refreshing to see a tech channel that's not riding musk for once. So many tech bros treat home like a god

[@tvathome562]

So even if the eastern block GTA gangs steal all USA Teslas, they don't have many charging ports (well maybe at home). So until their infrastructure catches up Tesla could be safe XD

[@lawrencemanns2182]

Was able to make a spare key card for my friends mom with blank nfc card and an Android phone using this exploit. Thanks!

[@xxX_420BlazeIt_Xxx]

What's stopping someone from going to a tesla dealer and going for a test drive, while a buddy clones the key nearby?

[@theRPGmaster]

Fear of punishment

[@monobrow538]

Licence plate You dont have a normal one in test drives

[@USAF1RST]

the Tesla will just drive itself back to the dealer

[@xxX_420BlazeIt_Xxx]

I see.

[@jacksonburger2081]

@@monobrow538 Couldn't you just "borrow" a license plate from a different car?

[@_averageenjoyer_]

As someone who had to learn to drive manually the joke about sticks sends me and makes me somewhat proud

[@milutinke]

Here is Europe everyone drives a manual

[@cherubin7th]

Thank you. Now I have to go out, some guys in the neighborhood have nice Teslas standing around...

[@glass7923]

We're one step closer to Watch Dogs hacking, how exciting!

[@desmond8746]

its called: passcode to drive

[@lazerusmfh]

I own two model Xs I love them despite the flaws best cars I’ve ever had have changed my life But I can afford them don’t buy one unless you have large disposable income, especially right now, and keep gas back up cars too. I love knowing I can drive even if gas is not available ( off grid storage and solar) Enable pin to drive if this flaw worries you. Features remain on cars Being transferred, (maybe some edge cases?) fed, etc. one of mine is second hand and I didn’t loose any features. (Fsd, etc) I’ve also had great warranty service having a drive unit and a battery replacement in 150k miles between ones I’ve had NFC I think can be secure, as a contractor, we use it for pretty secure access to some facilities…. Like I’m talking.. five eyes stuff, but it doesn’t mean it’s 100% secure of course

[@bigsyrup8567]

It feels good driving a manual RHD turbo Jimny. More attractive than a Tesla and more secure.

[@mifino]

Saying that NFC insecure and stupid to use is like saying that TCP is stupid and insecure. You can still build secure protocols like TLS on top of it.

[@RC-fp1tl]

>Elon doesn’t do any engineering! >This is all Elon’s fault Daum I hope they fix this. Whining on both sides is so annoying.

[@kim-hendrikmerk4163]

At this point it may be time to wipe the Tesla firmware and libre boot it.

[@rokilaiyangtzer1134]

Then remove all the geolocation hardware and software and boom, Tesla cant get the car back