Skip to main content

Bluetooth hack compromises Teslas, digital locks, and more

A group of security researchers has found a way to circumvent digital locks and other security systems that rely on the proximity of a Bluetooth fob or smartphone for authentication.

Using what’s known as a “link layer relay attack,” security consulting firm NCC Group was able to unlock, start, and drive vehicles and unlock and open certain residential smart locks without the Bluetooth-based key anywhere in the vicinity.

Tesla Model 3 keycard.
Image used with permission by copyright holder

Sultan Qasim Khan, the principal security consultant and researcher with NCC Group, demonstrated the attack on a Tesla Model 3, although he notes that the problem isn’t specific to Tesla. Any vehicle that uses Bluetooth Low Energy (BLE) for its keyless entry system would be vulnerable to this attack.

Recommended Videos

Many smart locks are also vulnerable, Khan adds. His firm specifically called out the Kwikset/Weiser Kevo models since these use a touch-to-open feature that relies on passive detection of a Bluetooth fob or smartphone nearby. Since the lock’s owner doesn’t need to interact with the Bluetooth device to confirm they want to unlock the door, a hacker can relay the key’s Bluetooth credentials from a remote location and open someone’s door even if the homeowner is thousands of miles away.

How it works

This exploit still requires that the attacker have access to the owner’s actual Bluetooth device or key fob. However, what makes it potentially dangerous is that the real Bluetooth key doesn’t need to be anywhere near the vehicle, lock, or other secured devices.

Instead, Bluetooth signals are relayed between the lock and key through a pair of intermediate Bluetooth devices connected using another method — typically over a regular internet link. The result is that the lock treats the hacker’s nearby Bluetooth device as if it’s the valid key.

As Khan explains, “we can convince a Bluetooth device that we are near it — even from hundreds of miles away […] even when the vendor has taken defensive mitigations like encryption and latency bounding to theoretically protect these communications from attackers at a distance.”

The exploit bypasses the usual relay attack protections as it works at a very low level of the Bluetooth stack, so it doesn’t matter whether the data is encrypted, and it adds almost no latency to the connection. The target lock has no way of knowing that it’s not communicating with the legitimate Bluetooth device.

Since many Bluetooth security keys operate passively, a thief would only need to place one device within a few feet of the owner and the other near the target lock. For example, a pair of thieves could work in tandem to follow a Tesla owner away from their vehicle, relaying the Bluetooth signals back to the car so that it could be stolen once the owner was far enough away.

These attacks could be carried out even across vast distances with enough coordination. A person on vacation in London could have their Bluetooth keys relayed to their door locks at home in Los Angeles, allowing a thief to quickly gain access simply by touching the lock.

This also goes beyond cars and smart locks. Researchers note that it could be used to unlock laptops that rely on Bluetooth proximity detection, prevent mobile phones from locking, circumvent building access control systems, and even spoof the location of an asset or a medical patient.

NCC Group also adds this isn’t a traditional bug that can be fixed with a simple software patch. It’s not even a flaw in the Bluetooth specification. Instead, it’s a matter of using the wrong tool for the job. Bluetooth was never designed for proximity authentication — at least not “for use in critical systems such as locking mechanisms,” the firm notes.

How to protect yourself

First, it’s essential to keep in mind that this vulnerability is specific to systems that rely exclusively on passive detection of a Bluetooth device.

For example, this exploit can’t realistically be used to bypass security systems that require you to unlock your smartphone, open a specific app, or take some other action, such as pushing a button on a key fob. In this case, there’s no Bluetooth signal to relay until you take that action — and you’re generally not going to try and unlock your car, door, or laptop when you’re not anywhere near it.

August Wi-Fi Smart Lock installed on door.
August smart lock August

This also won’t typically be a problem for apps that take steps to confirm your location. For instance, the auto-unlock feature in the popular August smart lock relies on Bluetooth proximity detection, but the app also checks your GPS location to make sure you’re actually returning home. It can’t be used to unlock your door when you’re already home, nor can it open your door when you’re miles away from home.

If your security system allows for it, you should enable an extra authentication step that requires that you take some action before the Bluetooth credentials are sent to your lock. For example, Kwikset has said that customers who use an iPhone can enable two-factor authentication in their lock app, and it plans to add this to its Android app soon. Kwikset’s Kevo application also disables proximity unlocking functionality when the user’s phone has been stationary for an extended period.

Note that unlocking solutions that use a mix of Bluetooth and other protocols are not vulnerable to this attack. A typical example of this is Apple’s feature that lets folks unlock their Mac with their Apple Watch. Although this does use Bluetooth to detect the Apple Watch nearby initially, it measures the actual proximity over Wi-Fi — mitigation that Apple’s executives specifically said was added to prevent Bluetooth relay attacks.

NCC Group has published a technical advisory about Bluetooth Low Energy vulnerability and separate bulletins about how it affects Tesla vehicles and Kwikset/Weiser locks.

Please enable Javascript to view this content

Jesse Hollington
Jesse has been a Mobile Writer for Digital Trends since 2021 and a technology enthusiast for his entire life — he was…
iPhone 17 Air leak offers a realistic look, and it’s not all that exciting
Alleged concept render of the iPhone 17 Air in black.

Apple is reportedly planning another overhaul of its smartphone lineup later this year, replacing the current Plus model with a new “Air” trim. So far, we have only seen concept renders and 3D-printed dummy units purportedly depicting the iPhone 17 Air, but a fresh leak offers the best glimpse at what the real thing could look like. 

Leakster MajinBu has shared an image titled “iPhone 17 Air” in which a person is depicted holding the upcoming phone’s realistic representation. It almost feels like a finished dummy unit, the kind you can easily find in retail stores. 

Read more
OnePlus 13s reveal: A compact flagship that many of us won’t be able to get
OnePlus 13s.

OnePlus has just announced a new addition to its lineup. Dubbed the OnePlus 13s, this is a more compact alternative to the excellent OnePlus 13, which we consider to be one of the best smartphones. The OnePlus 13s might be a good idea if you consider the base 13 to be too large -- as many flagships are -- but unfortunately, most of us won't be able to get our hands on this new phone just yet.

The company revealed the new phone and shared some basic information about what to expect from the OnePlus 13s. The phone, pictured in two color schemes -- one dark grey and one light pink -- will come with a 6.32-inch display, making it a better option for those on the hunt for a compact phone.

Read more
Apple’s smart glasses aim to put Apple Intelligence on your face
Apple iGlasses

Apple continues to develop its own smart glasses, as the company looks to fend off Meta’s success in the area with a competing product of its own. The Apple smart glasses – reportedly codenamed N50 – remain in development with the aim of bringing Apple Intelligence to your face.

While details of products in development from Apple are often scarce, Mark Gurman at Bloomberg has a great reputation for rooting out this information, telling us that Apple continues to be interested in developing its own smart glasses.

Read more