Passive Keyless Entry and Start Systems - DEF CON 27 Car Hacking Village

Lennert Wouters presents a deep dive into the security architecture of Passive Keyless Entry and Start (PKES) systems, focusing on critical cryptographic vulnerabilities discovered in the Tesla Model S key fob. Wouters details the reverse engineering of the key fob hardware manufactured by Pektron, exposing the use of an obsolete, proprietary 40-bit cipher (DST40) for wireless vehicle authentication.

He explains the creation of an efficient proof-of-concept attack capable of cloning a Tesla Model S key fob in a matter of seconds using inexpensive, commercial off-the-shelf software-defined radio (SDR) equipment and an evaluation board. By intercepting challenge-response exchanges broadcast over low-frequency (LF) and ultra-high-frequency (UHF) channels, the attack rapidly recovers the cryptographic key and spoofed authentication tokens, allowing unauthorized entry and vehicle ignition.

Wouters expands on the broader automotive implications by examining FCC database filings, revealing that identical Pektron PKES modules were deployed by other luxury automotive and motorcycle manufacturers, including McLaren, Karma Automotive, and Triumph Motorcycles. He concludes with an account of the coordinated vulnerability disclosure process, detailing how Tesla responded by rolling out software updates, introducing PIN-to-Drive protection, and ultimately transitioning to stronger cryptographic key fobs.

(AI summary — Gemini Flash)