Tesla Model 3 Body Transponder Chip Hack

All the ramblings for my Tesla Model 3 for my body hacking implants. Goal is to be able to start my Tesla Model 3 with my chip implant in hand.

PROJECT UPDATE LOGS ON HACKADAY.IO

Install video Warning: There is Blood

Tesla Model 3 Transponder Hack

Summary

Tesla Model 3 Hack with my transponder Implant.

AmieDD Tesla Model 3 Body hack implant

Tesla Model 3 Hack Webpage

Level 0: Prerequisites

Tesla Model 3

Valvet Key

Level 1. Hardware - Transponder NFC/RFID Implant

Body Implant Location: Left Hand

X-Series transponder implant in bioglass encased device that I had injected through a hollow needle

xNT NFC was purchased from Dangerous Things

**Price: $99 USD

**Specs: xNT tag – 13.56MHz ISO14443A & NFC Type 2 NTAG216 chip

• 2x12mm cylindrical sterile biocompatible implant package
• ISO14443A – compatible with all ISO14443A RFID systems
• Fully NFC Type 2 compliant – compatible with all NFC devices

Level 2. Hardware - Tesla Model 3

2018 Tesla Model 3

Level 3. Tesla Model 3 Valet Key Data

I was able to read data on my Tesla Model 3 Valet Key

Tag Type: ISO 14443-4 NXP IBM JCOP

Technology: ISODep, NfcA

Serial Number: NOT Telling

ATQA: 0x0048

SAK: 0x20

Global Platform Information:

• Java Card version 2.2
• Global Platform version 2.1.1
• GP Secure Channel Protocol: 03 option 10 -Max. length APDU data field: 255 bytes
• Global Platform card manager FCI:0x6F108A000000151000000A5049F6501ff

Technologies supported

• ISO/IEC 7816-4 compatible
• ISO/IEC 14443-4 (Type A) compatible
• ISO/IEC 14443-3 (Type A) compatible
• ISO/IEC 14443-2 (Type A) compatible

Detailed Protocol Information

• ID: 04:25:2E:6A:F5:51:80
• ATQA: 0x4800
• SAK: 0x20
• ATS: 0x0578779102
• Max. accepted frame size: 256 bytes (FSCI: 8)
• Supported received rates: 106, 212, 424, 848kbit/s(DR: 1,2,4,8)

Additional valet keys are $5 + tax so around $8.50

**Amie’s rambling side notes: what I find interesting is that there is no external identifier on the back or front of the valet key cards. So if you were to park in valet with 50 other Tesla Model 3, how would tell be able to tell the difference in your key card and someone else’s. Similar to hotel room keys where they just match it to the hotel room.

I’ve ordered 2 more keys and I’m going to have a Tesla service technician come out and show me how he pairs the keys to my car.

Made appointment(Monday November 26th) with Tesla to have the service technician come to my house to connect a few valet cards to see the process. I know at the Tesla service center they take your car in the back and connect the valet keycards in the back shop area. My hopes are that they having the service come to my house that I will be able to see the process of connecting the valet key to the car.

Level 4. Tesla Open Source

Tesla Model 3 Open Source

Level 5. Tesla Valet Key

Level 6. Bug Crowd

I'm part of Telsa bug crowd bounty, and I've been looking through, to see what information I can get from the car, to see if writing data to my current rfid hand implant is a possibility.

While we use Bugcrowd as a platform for rewarding all issues, please report vehicle and product related issues directly to vulnerability@teslamotors.com, using our GPG key to encrypt reports containing sensitive information.

Targets

In scope

• A hardware product that you own or are authorized to test against (Vehicle/PowerWall/etc.)
• Hardware
• *.tesla.com
• Website
• *.tesla.cn
• Website
• *.teslamotors.com
• Website
• *.tesla.services
• Website
• Any host verified to be owned by Tesla Motors Inc. (domains/IP space/etc.)
• Website
• Official Tesla Android apps
• Android
• Official Tesla iOS apps

iOS

Out of scope

shop.eu.teslamotors.com

feedback.teslamotors.com

ir.teslamotors.com

ir.tesla.com

mkto.teslamotors.com

Any other third-party websites hosted by non-Tesla entities

Any SolarCity property, including *.solarcity.com

 

Sacrificing for the cause: Melting my Tesla Valet cards with acetone to get the chip Melting the Tesla Model 3 Valet key with acetone

Process took 1.5 hours to dissolves using glass container. Strange that it dissolved from the center.( I assume because of the Tesla logo).

Success!!! We have a chip!! AmieDD Tesla Model 3 Body hack implant

Tesla Model 3 Valet Key Chip

Tesla software update key fob

**Amie’s rambling notes: I called the Telsa service center in Dallas on 11/7/2018 and they said the key fobs aren’t out yet.

11/10/2018 Key Fob's were released on Tesla's webpage, already sold out. Price $150

Tesla Model 3 Transponder Hack

Version: 0.42

Contributors

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Amie DD 💻

This project follows the all-contributors specification. Contributions of any kind welcome!