PhoneKey

The security of Tesla’s cars has been a hot topic in recent months. In addition to being one of the safest cars on the road, it is also well-protected from hacks and attacks. But how does Tesla make sure their vehicles are safe and secure?

Note: This is related to Project TEMPA. Please follow this link for an overview! The Tesla Authorization Replay attack is using a tool like temparary in order to extract VCSEC AuthorizationResponses from a whitelisted smartphone app. For AuthorizationRequests - that are mainly used for passive entry functions - the vehicle communicates a challenge token, that the smartphone app has to answer with an AuthorizationResponse which is embedded in a VCSEC SignedMessage object that has a SIGNATURE_TYPE_AES_GCM_TOKEN SignatureType.

Note: This is related to Project TEMPA. Please follow this link for an overview! The Tesla Crypto Counter Confusion attack works by impersonating a vehicle with a tool like temparary. Once the app on the owner’s phone starts communicating to the emulated BLE interface of the impersonated car, the temparary tool will request an authorization from the phone.

temparary.py is a pybleno-based python script, that acts as a VCSEC peripheral. Currently, the tool is very experimental and implements rudimentary interactions, only! https://github.com/trifinite/temparary This tool has been released in the context of Project TEMPA Disclaimer While it’s very TEMPting to use this tool in order to impersonate random cars, we advise you to only use this tool on vehicles and smartphones you own or have permission to use.

Note: This is related to Project TEMPA. Please follow this link for an overview! The Tesla Key Drop attack works by impersonating a vehicle with a tool like temparary. Once the app on the owner’s phone starts communicating to the emulated BLE interface of the impersonated car, the temparary tool will request an authorization from the phone.

Note: This is related to Project TEMPA. Please follow this link for an overview! After unlocking the vehicle via NFC, Tesla allows potential attackers to store a key on the vehicle for a period of approx. 130s. No warning or similar will be displayed on the vehicle screen during this process.

tempara.py is a Bleak-based python script, that acts as a VCSEC client. Currently, the tool is very experimental and implements rudimentary commands, only! https://github.com/trifinite/tempara This tool has been released in the context of Project TEMPA Disclaimer While it’s very TEMPting to use this tool to connect to random cars, we advise you to only use this tool on vehicles you own or have permission to use.

Note: This is related to Project TEMPA. Please follow this link for an overview! Besides the ability to relay the 2.4GHz radio signal between the PhoneKey and the Tesla vehicle, it is also possible to relay information on protocol level by using standard software like gattacker.

This archive can be found on github and contains all VCSEC protocol buffers definitions (aka proto-files). Additionally, there are two shell scripts that showcase the usage of the protoc tool, which is a pre-requisite for working with these files. https://github.com/trifinite/vcsec-archive

VINTAG is an API client for trifinite's Tesla VIN Identifier API on rapidAPI