October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan NowOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
CarCodyAdvertise
Service recordThe Garage

How a Belgian Researcher Hacked a Tesla Model X Key Fob with a Raspberry Pi

The 2020 Tesla Model X incident was a key-fob BLE firmware attack, not a Raspberry Pi stealing a car by itself. Here is the sequence, the reported figures and the limits of the claim.
Entry955 Date Time4 min MechanicCarCody Team
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Short answer: A Raspberry Pi was one component in a specialist 2020 proof of concept against the Tesla Model X passive-entry key fob. The researchers exploited an inadequately secured Bluetooth Low Energy (BLE) firmware-update mechanism, first obtaining valid unlock messages and then carrying out additional vehicle-specific steps. A Raspberry Pi alone could not unlock or drive a Tesla, and the demonstration did not establish how often this could happen in the wild.

What was actually hacked?

The affected component was the Model X key fob and its BLE interface—not the Raspberry Pi and not a general Tesla control system. Researchers from KU Leuven’s COSIC group—Lennert Wouters, Benedikt Gierlichs and Bart Preneel—reported the work in 2020. Computer Weekly’s account was published on 24 November 2020.

As an Amazon Associate I earn from qualifying purchases.

The weakness was an inadequately protected remote software-update mechanism on the fob’s BLE chip. Once the researchers made a nearby fob advertise as a connectable BLE device, they could remotely rewrite its software and take control of it.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How the proof of concept worked

1. A modified vehicle ECU prompted the fob

The team used a salvaged Model X engine-control unit modified for the experiment. Wouters told Computer Weekly that it could wirelessly force nearby key fobs to advertise as connectable BLE devices. The report gives an operating distance of about 5 metres.

#1 Best Overall
CanaKit Raspberry Pi 4 4GB Starter PRO Kit - 4GB RAM
  • Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM)
  • Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
  • CanaKit Premium High-Gloss Raspberry Pi 4 Case with Integrated Fan Mount, CanaKit Low Noise Bearing System Fan
  • CanaKit 3.5A USB-C Raspberry Pi 4 Power Supply (US Plug) with Noise Filter, Set of Heat Sinks, Display Cable - 6 foot (Supports up to 4K60p)
  • CanaKit USB-C PiSwitch (On/Off Power Switch for Raspberry Pi 4)

2. The fob’s update process was compromised

With the fob exposed as a connectable BLE device, the researchers reached its remotely accessible update mechanism. Because that mechanism was not properly secured, they could install their own software and obtain valid messages used to unlock the car.

Wouters described the result as taking “full control” of the fob and then obtaining valid unlock messages. That statement is attributed to Wouters as quoted by Alex Scroxton in Computer Weekly’s 24 November 2020 report.

Rank #2
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (8GB RAM)
  • Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM)
  • Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
  • CanaKit Turbine Black Case for the Raspberry Pi 5
  • CanaKit Low Noise Bearing System Fan
  • Mega Heat Sink - Black Anodized

3. Unlocking was not the same as driving away

The published scenario separates unlocking from starting the vehicle. To proceed beyond unlocking, the researchers also described gaining physical access to the vehicle’s onboard diagnostic connector and pairing a modified fob. Those additional requirements matter: the demonstration was not simply a person standing five metres away with a Pi and immediately driving off.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Where the Raspberry Pi fits

The Raspberry Pi was one item in a larger laboratory setup that included a modified key fob, a salvaged Model X ECU and other electronics. The report does not identify the Pi model. It therefore should be understood as a general single-board computer used within a custom hardware-and-software system, not as a consumer attack kit.

Rank #3
CanaKit Raspberry Pi 3 B+ (B Plus) Starter Kit (32 GB EVO+ Edition, Premium Black Case)
  • Includes Made in UK Raspberry Pi 3 B+ (B Plus) with 1.4 GHz 64-bit Quad-Core Processor, 1 GB RAM
  • Dual Band 2.4GHz and 5GHz IEEE 802.11.b/g/n/ac Wireless LAN, Enhanced Ethernet Performance
  • Includes 32 GB EVO+ Micro SD Card (Class 10) Pre-loaded with OS, USB MicroSD Card Reader
  • CanaKit 2.5A USB Power Supply with Micro USB Cable and Noise Filter - Specially designed for the Raspberry Pi 3 B+ (UL Listed)
  • Premium Raspberry Pi 3 B+ Case, Display Cable, 2 x Heat Sinks, GPIO Quick Reference Card, CanaKit Full Color Quick-Start Guide

Calling this “a Tesla hack with a Raspberry Pi” is shorthand for the equipment used in the proof of concept. It does not mean that installing an app on any Raspberry Pi gives access to Tesla vehicles.

Figures reported for the 2020 demonstration

Measure Reported result Qualification
Target Tesla Model X passive-entry BLE key fob Historical 2020 research, not every Tesla model
Proximity to prompt a fob About 5 metres Computer Weekly’s description of the proof of concept
Fob-compromise time About 90 seconds Reported for this demonstration, not a general theft statistic
Component cost $195 (£144/€162) Total proof-of-concept components as reported by Computer Weekly in 2020
Vehicle price context $100,000 (£82,000/€83,500) Model X price quoted in that 2020 story; not a current price

These numbers describe the published laboratory demonstration. They do not show that all Model X vehicles, all Tesla key fobs or all attacks can be compromised at the same distance, cost or speed.

Rank #4
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (4GB RAM)
  • Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (4GB RAM)
  • Includes 128GB Micro SD Card pre-loaded with 64-bit Raspberry Pi OS, USB MicroSD Card Reader
  • CanaKit Turbine Black Case for the Raspberry Pi 5
  • CanaKit Low Noise Bearing System Fan
  • CanaKit Mega Heat Sink - Black Anodized
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Tesla’s response

Computer Weekly reported that Tesla issued an over-the-air software patch after the researchers notified the company. The available account does not establish the present software status of every Model X in service, so the 2020 result should not be treated as a current fleet-wide vulnerability claim.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Erich Kron, identified by Computer Weekly as a security-awareness advocate at KnowBe4, praised Tesla’s rapid fix and the researchers’ decision to notify the company before public release. That comment is also attributed to Kron through Scroxton’s 24 November 2020 report.

Best Value
Freenove Ultimate Starter Kit for Raspberry Pi 5 4 Zero 2 W (NOT Included)
  • 5 sets of code: Python (compatible with 2&3), C, Java, Scratch and Processing (Scratch and Processing code provide graphical interfaces)
  • Detailed tutorial: Can be downloaded (in English, 962-page in total) or viewed online (original in English, can be translated into other languages by browsers) (The tutorial link can be found on the product box, no paper tutorial)
  • 128 projects from simple to complex: Provides step-by-step guide with electronics and components knowledge, each project has schematics, wiring diagrams, complete code and detailed explanations
  • 223 items in total: This ultimate kit includes the most commonly used electronic components, modules, sensors, wires and other compatible items
  • Compatible models: Raspberry Pi 5 / 500 / 400 / 4B / 3B+ / 3B / 3A+ / 2B / 1B+ / 1A+ / Zero 2 W / Zero W / Zero (NOT included in this kit)

Why this is often confused with a Model S story

KU Leuven researchers had also discussed Tesla Model S key-fob security in a 2018 Raspberry Pi editorial. That was a separate result involving cryptographic weaknesses and different radio/computing equipment. The 2020 Model X incident concerns BLE advertising and remote rewriting of fob firmware. Shared researchers and the presence of a Raspberry Pi do not make the two exploits one attack.

Can a Raspberry Pi hack a Tesla?

Not by itself. In this case, the Pi was a building block in a purpose-built setup that depended on a vulnerable Model X fob, a modified ECU, custom firmware and additional physical access to the vehicle’s diagnostic connector. The published work demonstrates a historical design flaw, not a plug-and-play method for stealing Teslas.

What responsible testing looks like today

Tesla’s current product-security guidance says researchers may request pre-approval and registration of research vehicles. It asks researchers to:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • Work only on vehicles they own or are explicitly authorized to test.
  • Avoid privacy violations, damage, service interruption and other harm.
  • Report vehicle and energy-product vulnerabilities through Tesla’s designated security channel.
  • Allow reasonable time for Tesla to investigate and correct a flaw before public disclosure.

Those are present-day policy conditions. They should not be read as proof that the 2020 team followed wording that may not have existed at the time.

Quick Recap

Bestseller No. 1
CanaKit Raspberry Pi 4 4GB Starter PRO Kit - 4GB RAM
CanaKit Raspberry Pi 4 4GB Starter PRO Kit - 4GB RAM
Includes Raspberry Pi 4 4GB Model B with 1.5GHz 64-bit quad-core CPU (4GB RAM); Includes Pre-Loaded 32GB EVO+ Micro SD Card (Class 10), USB MicroSD Card Reader
$159.99
Bestseller No. 2
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (8GB RAM)
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (8GB RAM)
Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (8GB RAM); CanaKit Turbine Black Case for the Raspberry Pi 5
$259.95
Bestseller No. 3
CanaKit Raspberry Pi 3 B+ (B Plus) Starter Kit (32 GB EVO+ Edition, Premium Black Case)
CanaKit Raspberry Pi 3 B+ (B Plus) Starter Kit (32 GB EVO+ Edition, Premium Black Case)
Dual Band 2.4GHz and 5GHz IEEE 802.11.b/g/n/ac Wireless LAN, Enhanced Ethernet Performance
$109.99
Bestseller No. 4
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (4GB RAM)
CanaKit Raspberry Pi 5 Starter Kit PRO - Turbine Black (128GB Edition) (4GB RAM)
Includes Raspberry Pi 5 with 2.4Ghz 64-bit quad-core CPU (4GB RAM); CanaKit Turbine Black Case for the Raspberry Pi 5
$209.99

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

More from the Garage

  1. Entry001Date09 OCT 26Time3 minWhich Brake Pad Should You Buy From RockAuto or Elsewhere?Section: Blog
  2. Entry002Date09 OCT 26Time5 minThe Pros and Cons of Touchless Car Wash SystemsSection: Blog
  3. Entry003Date09 OCT 26Time3 minCan a Trickle Charger or Battery Tender Properly Charge a Car Battery?Section: Blog

Thanks for visiting Carcody

Carcody.com is a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for sites to earn advertising fees by advertising and linking to amazon.co

Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.