Security researchers at NCC Group have shown that a link-layer relay attack can trick Bluetooth-based proximity authentication into thinking the paired key is right next to the device, when it can be hundreds of miles away. The attack works against certain cars and smart locks, including a Tesla Model 3, even when defenses like encryption and latency checks are in place.
The key insight: this is not a Bluetooth bug. It is Bluetooth being asked to do a job it was never designed for.
The short version
| Aspect | Detail |
|---|---|
| Attack type | Link-layer relay on Bluetooth Low Energy |
| Vehicles affected | Tesla Model 3 (demonstrated); all BLE passive-entry vehicles potentially vulnerable |
| Locks affected | Kwikset/Weiser Kevo (touch-open models) |
| Defenses bypassed | Encryption, latency checks |
| Key requirement | One attacker device near victim; one near target; internet bridge between them |
| Exploitability | High for passive systems; low for systems requiring explicit user action |
How the attack actually works
Bluetooth Low Energy was built for short-range, low-power communication, not for proving that a specific key is in a specific room. The researchers found a way to relay the radio conversation between a valid key and a target device through two attacker-controlled BLE nodes bridged over the internet. The lock sees a familiar key at a familiar signal strength, opens up, and never knows the key is on a different continent.
The version of the attack against the Kevo smart lock is especially bad because the lock opens on touch without any user interaction. With cars, the attacker still needs a small window in which the victim walks away, but that is not exactly rare in a parking lot.
Our analysis
The uncomfortable truth is that the security industry has been warning about relay attacks on keyless entry for years, and the response from product teams has been incremental at best. Adding latency checks and rolling codes helps against sloppy implementations, but the link-layer approach described here sidesteps both. If the protocol is willing to be fooled at the radio layer, no amount of cryptography on top will save you.
The trade-off is stark: passive proximity is the entire selling point of these locks and fobs. Forcing a button press or a phone unlock kills the magic, and vendors know it. That is why this class of attack is not going away with a patch, and why NCC Group calls it a misuse of the underlying technology rather than a bug.
Who wins and loses here? Consumers lose certainty about their physical security. Vendors who built entire product lines around passive proximity lose a differentiating feature. The winners are vendors who already used hybrid approaches (Bluetooth plus Wi-Fi ranging, or Bluetooth plus GPS validation) and security consultants like NCC Group who will be busy auditing implementations.
What to watch: whether vendors respond with genuine redesigns or cosmetic patches that claim to fix the problem while leaving the fundamental weakness intact. Apple's approach—using Wi-Fi for actual proximity measurement after using Bluetooth for initial detection—suggests a viable path forward, but it requires hardware changes for products already deployed.
How to act on it
Say you own a Tesla and a Kevo lock. Today: turn off passive entry on the Tesla and require the phone or key card to be physically tapped. On the Kevo, disable touch-to-open and use the app-based unlock with two-factor confirmation. For any smart lock, prefer a model that requires an explicit action—such as pressing a button in the app or entering a code—before it opens. And treat your Bluetooth fob like a house key. If you lose it, assume the lock is compromised until you re-pair.
What to watch next
Watch for NCC Group's full advisory and any vendor responses. Expect some vendors to push firmware updates that add additional challenge-response checks, and expect others to do nothing because the problem is fundamental to their design. The long-term fix is moving away from passive proximity for anything that controls physical access, which is going to be a slow and annoying transition.
Bottom line: passive Bluetooth proximity is not a security control. It is a UX feature with a lock icon on top. Act accordingly.
Key takeaways
- Link-layer relay attacks can defeat encryption and latency checks on BLE proximity systems.
- The Tesla Model 3 and certain Kwikset/Weiser Kevo locks were confirmed vulnerable.
- Disabling passive entry and requiring an explicit action is the practical mitigation.
- Bluetooth was not designed to be a proximity authenticator for physical access, and the cost of that mistake is now visible.
Frequently asked questions
What is a Bluetooth relay attack?
It is an attack where two attacker devices relay Bluetooth signals between a valid key and a target device over a longer channel, such as the internet, so the target believes the key is nearby.
Do I need to worry if my car uses a key fob with buttons?
The attack primarily affects passive entry systems that unlock without user interaction. Fob-based systems that require a button press are much harder to abuse this way.
Is Tesla more vulnerable than other car brands?
The researcher noted the issue is not specific to Tesla. Any vehicle using Bluetooth Low Energy for passive keyless entry is potentially exposed.
Can this be fixed with a software update?
For some implementations, yes. For others, the design itself is the problem, and the fix is changing how the product authenticates the user, not patching Bluetooth.
What should I do today to reduce exposure?
Turn off passive entry where possible, prefer locks that require an explicit action to open, and treat lost fobs as compromised until you re-pair or rotate credentials.