My other car is your car: compromising the Tesla Model X keyless entry system

This paper documents a practical security evaluation of the Tesla Model X keyless entry system. In contrast to other works, the keyless entry system analysed in this paper employs secure symmetric-key and public-key cryptographic primitives implemented by a Common Criteria certified Secure Element. We document the internal workings of this system, covering the key fob, the body control module and the pairing protocol. Additionally, we detail our reverse engineering techniques and document several security issues. The identified issues in the key fob firmware update mechanism and the key fob pairing protocol allow us to bypass all of the cryptographic security measures put in place. To demonstrate the practical impact of our research we develop a fully remote Proof-of-Concept attack that allows to gain access to the vehicle’s interior in a matter of minutes and pair a modified key fob, allowing to drive off. Our attack is not a relay attack, as our new key fob allows us to start the car anytime anywhere. Finally, we provide an analysis of the update performed by Tesla to mitigate our findings. Our work highlights how the increased complexity and connectivity of vehicular systems can result in a larger and easier to exploit attack surface.

Exploring chemical diversity via a modular reaction pairing strategy

The efficient synthesis of an 80-member library of unique benzoxathiazocine 1,1-dioxides by a microwave-assisted, intermolecular nucleophilic aromatic substitution (SNAr) diversification pathway is reported. Eight benzofused sultam cores were generated by means of a sulfonylation/SNAr/Mitsunobu reaction pairing protocol, and subsequently diversified by intermolecular SNAr with ten chiral, non-racemic amine/amino alcohol building blocks. Computational analyses were employed to explore and evaluate the chemical diversity of the library.