A group of researchers from the Technical University of Berlin and independent researcher Oleg Drokin have found a way to jailbreak the AMD-based infotainment systems used in all recent Tesla car models. This hack allows them to extract the unique hardware-bound RSA key that Tesla uses for car authentication in its service network, as well as voltage glitching to activate software-locked features such as seat heating and ‘Acceleration Boost’ that Tesla car owners normally have to pay for.
How the Hack Works
Tesla infotainment APU is based on a vulnerable AMD Zen 1 CPU. The researchers were able to hack the infotainment system using techniques based on the team’s previous AMD research, which uncovered the potential for fault injection attacks that can extract secrets from the platform. By using a known voltage fault injection attack against the AMD Secure Processor (ASP), serving as the root of trust for the system, the researchers were able to subvert the ASP’s early boot code. They then reverse-engineered the boot flow to gain a root shell on their recovery and production Linux distribution. By gaining root permissions, the researchers were free to perform arbitrary changes that survive infotainment system reboots and Tesla ‘over-the-air’ updates. Moreover, they could access and decrypt sensitive information stored on the car’s system, such as the owner’s personal data, phonebook, calendar entries, call logs, Spotify and Gmail session cookies, WiFi passwords, and locations visited.
Implications of the Hack
The jailbreak enables an attacker to extract the TPM-protected attestation key that Tesla uses to authenticate the car and verify its hardware platform’s integrity, and migrate it to another car. Besides car ID impersonation on Tesla’s network, this could also help in using the car in unsupported regions or performing independent repairs and modding, explain the researchers.
Tools Needed for the Hack
According to one of the researchers, Christian Werling, a soldering iron and $100 worth of electronic equipment, like the Teensy 4.0 board, should be enough to jailbreak Tesla’s infotainment system.
Tesla’s Response
The researchers responsibly disclosed their findings to Tesla, and the carmaker is in the process of remediating the discovered issues. However, the key extraction attack still works in the latest Tesla software update, so the problem remains exploitable for now, Werling told BleepingComputer.
Conclusion
The researchers have found a way to jailbreak Tesla infotainment system, which allows them to extract sensitive information and activate software-locked features such as seat heating and ‘Acceleration Boost’ for free. The hack also enables an attacker to extract the TPM-protected attestation key that Tesla uses to authenticate the car and verify its hardware platform’s integrity, and migrate it to another car. Tesla is currently working on remediating the discovered issues.