BlueBait is a technique that lures a smartphone phone-key into reaching out and revealing itself by presenting a tempting, attacker-controlled BLE peer — the TEMPA honeypot. Instead of waiting for the target to show up, the attacker baits the phone into first contact.

Support trifinite.org via the Amazon Affiliate Program Amazon offers the possibility to pay out commissions to their partners when customers use their affiliate link before any purchase. Therefore, please make sure to check out the products on the respective page that serves your location:

The security of Tesla’s cars has been a hot topic in recent months. In addition to being one of the safest cars on the road, it is also well-protected from hacks and attacks. But how does Tesla make sure their vehicles are safe and secure?

Note: This is related to Project TEMPA. Please follow this link for an overview! The Tesla Crypto Counter Confusion attack works by impersonating a vehicle with a tool like temparary. Once the app on the owner’s phone starts communicating to the emulated BLE interface of the impersonated car, the temparary tool will request an authorization from the phone. After receiving a VCSEC AuthorizationResponse from the smartphone, the temparary tool will claim, that the crypto counter value that was used for the AutorizationResponse was SMALLER_THAN_EXPECTED. The smartphone app will then ask the vehicle for the actual Session Information, which includes the actual crypto counter value and the challenge token that is going to be sent with future AuthorizationRequests.

Note: This is related to Project TEMPA. Please follow this link for an overview! The Tesla Authorization Replay attack is using a tool like temparary in order to extract VCSEC AuthorizationResponses from a whitelisted smartphone app. For AuthorizationRequests - that are mainly used for passive entry functions - the vehicle communicates a challenge token, that the smartphone app has to answer with an AuthorizationResponse which is embedded in a VCSEC SignedMessage object that has a SIGNATURE_TYPE_AES_GCM_TOKEN SignatureType.