"Unpatchable" exploit found in Tesla cars, allowing jailbreaking of internal computer

[da na]

First of all, I hope this does not break forum rules on piracy.

 

Summary

A security reasercher and three German students reportedly have discovered an exploit unlocking paid features in AMD-based Tesla cars, making this the world's first Tesla jailbreak. The hack exploits a vulnerability in the MCU (Media Control Unit), "tricking the car" into thinking premium subscription features have been paid for. 

Further, the researchers claim the attack is "Unpatchable" as it is based on a vulnerability in the embedded AMD Secure Processor, not in any of Tesla's software. 

Jailbreaking the car's computer does not only give the user access to paid premium features; however - theoretically, users could run any code they want once the vehicle is jailbroken. 

The researchers have reported they used "low-cost, off-the-shelf hardware" (or "off-the-self", as the article says) to accomplish the jailbreak.

 

Quotes

Quote

According to the researchers, the attack is unpatchable on current cars, meaning that no matter what software updates are pushed out by Tesla, attackers—or perhaps even DIY hackers in the future—can run arbitrary code on Tesla vehicles as long as they have physical access to the car. 

 

My thoughts

It was bound to happen eventually, anything with what is functionally an entire computer in it will of course be exploitable to some degree. Paid subscriptions for car features is absolute bullshit, but I would not be surprised if X-Corp starts permanently locking the vehicles of people who attempt this exploit, if the means to do so ever are revealed to the public. 

 

Sources

https://www.thedrive.com/news/tesla-hackers-find-unpatchable-jailbreak-to-unlock-paid-features-for-free

[Crunchy Dragon]

"you wouldn't download a car"

[BlueChinchillaEatingDorito]

Well we know who's next.

[thrasher_565]

tuning is back!

 

am i surprised... nop. 

Edited August 6, 2023 by thrasher_565

[HenrySalayne]

Which features are even software-locked in a Tesla?

Heaters? Battery capacity? Performance? Windshield wipers? Driving assist features?

[circeseye]

35 minutes ago, HenrySalayne said:

Which features are even software-locked in a Tesla?

Heaters? Battery capacity? Performance? Windshield wipers? Driving assist features?

driving assist, performance, fast charging, heated seats, and im sure much more

a lot of car companies are doing it

[wanderingfool2]

36 minutes ago, HenrySalayne said:

Which features are even software-locked in a Tesla?

Heaters? Battery capacity? Performance? Windshield wipers? Driving assist features?

Autopilot/FSD being the major feature locked behind a paywall...although in Tesla's defense to that they are pumping in like billions of dollars on the supercomputers that's training them.  (Normal driver assist stuff is provided already)

 

Technically the plaid also has an expensive option for faster acceleration locked behind software (which I think gets enabled if you buy the tesla hardware, can't recall didn't really look into it as it's well out of my price range)...since things like the brakes needs to be up to spec otherwise you can run into issues.

 

The rear heated seats used to be a feature unlock, but they just increased the price on the base model and included it.

 

Battery capacity was an option for some people, who had purchased things like lower X kWh batteries but their vehicle was equipped (or warranty replaced with a higher capacity).  So for example, they paid the price for a 65 kWh, but really got a 75 kWh one; so there was an "upgrade" you could pay for to unlock the other 10 kWh (which iirc was set at the difference between what the 65kWh vs 75kWh cost).

 

There was also one where you could get better acceleration on normal vehicles as well...but from what I understand that was also locked behind a paywall because they expected the people who purchased it to essentially have to warranty their batteries more often (so the cost essentially was offsetting the additional cost to Tesla for the eventual warranty repairs)

 

I guess in theory as well, some of the app stuff might also be behind software as a service...like using music apps (which in that case it's using the cell data from the car)...so in theory that could maybe be accessed.  Although in a case like that, where the vehicle is actively using Tesla server's I'm sure they will detect jailbreaks quite quickly and ban them from the network...good luck getting your car serviced if they found you running jailbroken software on the vehicle; wouldn't be surprised if they refuse to service it (as this level of jailbreaking could have safety implications if you installed something bad).

 

 

 

The thing is though, tricking your Tesla into some of these "purchases" isn't exactly new, people have already been doing it...it's just you tend to sacrifice things such as being able to connect your Tesla to any network (which means goodbye to the maps, and most of the other useful features in a Tesla).  There was a hacker a while back who got his Tesla to render the voxels that was used in Autopilot/FSD.  What I think this allows though is for you to keep it more on the Tesla network.

[MSMSMSM]

I feel within devices that are always-online, the "unpatchable" nature of an exploit doesn't really matter as much as you'd want it to. You still need to use Tesla's online services, they still have your name and credit card on file, they know what you bought, you might be able to trick the client into thinking it has authorization for services that haven't been paid for but it's likely that it'll still make calls to the server, who know that you didn't pay for it.

 

Now, you could go the normal way and just go "access denied" or you allow access but you log it and if the calls are made repeatedly despite not being paid for and you know your software doesn't allow for such calls without the software being paid for, then... you can hold onto that information, let people get used to it, then start bricking the devices remotely through ban waves (ToS violations prohibiting you from using online services... and your device is useless without said online services) and demand a penalty (or service fee, however you wish to style it) to unbrick it and have your account unblocked from online services.

 

This would spook modders and even if the device can be unbricked, it'll still act as a deterrence for the casuals.

 

Now, how would... using heated seats need an internet connection? Ideally, it shouldn't. But, you can be quite creative in making things that don't need an internet connection need one (if not continuously, which would be too disruptive for legitimate customers, but every n days).

 

For example, you can have a dedicated controller for the heated seats and have the firmware encrypted and require an internet connection to decrypt it or you can, on device boot, as long as device's last online was <n days, flash the firmware onto the controller and then when it's >n days, delete the firmware from local storage, requiring a re-fetch from the server the next time the device is powered on.

 

This could be mitigated by installing your own chip, which itself is quite an ask from a casual modder, but that can be mitigated by serialization and chain-of-trust measures.

 

The possibilities of being anti-consumer are endless. The more likely uses imo are vulnerability research and installing completely custom firmware (instead of patching piecemeal, which is simply attrition warfare between modders and the developers). 

[Thaldor]

Well, ain't this a good news for those who have planned to buy second hand Tesla, kick Don Musk out of it and make it their own car. No more need for 3rd party control units when you can turn the one inside into something useful.

[RejZoR]

Subscription features in cars need to die. One thing is paying for a service that requires company time and is extra cost for them, like running servers for remote features. Fair enough, if they offer them for decades even to old cars, fair enough. But charging people monthly for heated seats and other similar bullshit, then no. Absolutely not and I hope more get hacked to a level they'll abandon this dumb idea. Which we all know it'll never happen and they'll just utilize even more draconian DRM measures, but hope is there.

[wanderingfool2]

2 hours ago, RejZoR said:

Subscription features in cars need to die. One thing is paying for a service that requires company time and is extra cost for them, like running servers for remote features. Fair enough, if they offer them for decades even to old cars, fair enough. But charging people monthly for heated seats and other similar bullshit, then no. Absolutely not and I hope more get hacked to a level they'll abandon this dumb idea. Which we all know it'll never happen and they'll just utilize even more draconian DRM measures, but hope is there.

I think one thing that should also be clarified, the "subscriptions" for Tesla also has purchase options.  The extra cost thing is also a tricky situation; Tesla's for example were built with heated seats, (and like $300 "upgrade").  It would cost more to build each car, but it's offset by the amount of people who would purchase it.  You could see that when they provided the heated seats and shortly after the price increased.

 

The battery range one is a funny thing as well.  You can sell the vehicles with more battery, but at a cheaper initial cost knowing most people will eventually upgrade (lower upfront cost essentially).  It also had the perk that the "cheaper" vehicle could also sometimes make the vehicle low enough in price to get the tax credits for yourself...so what some people did was bought the shorter range, then later upgraded.

 

An issue I see though with EV's, eventually most legacy autos will have to move towards that to make their profits.  Ford/GM both are losing money on each EV they sell and the old dealership model of sell some at almost costs and make it back up through servicing (or in recent years loans) doesn't really work with EV's.

 

One thing you -might- see in future Tesla's though.  Depending on how much they want to fix this, is essentially epoxying the pins like some other manufacturers do.  This has the major downside of it being non-repairable though...which isn't great.

[HenrySalayne]

13 hours ago, wanderingfool2 said:

The battery range one is a funny thing as well.  You can sell the vehicles with more battery, but at a cheaper initial cost knowing most people will eventually upgrade (lower upfront cost essentially).  It also had the perk that the "cheaper" vehicle could also sometimes make the vehicle low enough in price to get the tax credits for yourself...so what some people did was bought the shorter range, then later upgraded.

Ahh, yes, the positives you find are tax evasion or scrounging some subsidies.

 

They are actually wasting resources to build extra battery capacity in every car to extort additional money from customers at a later point. That's not a benefit.

 

Hardware should not be paywalled.

[wanderingfool2]

58 minutes ago, HenrySalayne said:

Ahh, yes, the positives you find are tax evasion or scrounging some subsidies.

 

They are actually wasting resources to build extra battery capacity in every car to extort additional money from customers at a later point. That's not a benefit.

 

Hardware should not be paywalled.

It's sidestepping needlessly asinine government regulations that haven't caught up with the times.  When the goal is saving customers money, then yea it's a positive.  As an example in BC; if you sell an EV for $56,999 you would pay about $5129.91 in taxes.  Add one "extra" like lets say heated seats for $200...($57,199), you now are paying $5719.90 in tax...ie almost $600 more in taxes for simply adding on a $200 to the cost...why because it's considered a "luxury" car tax.

 

Similar thing happens when you do LR model EV's.  So yes, it's a positive buying a range to save on taxes.  It benefits the customer doesn't hurt the government in that the tax never considered the possibility that EV technology would cost more to build than a luxury ICE vehicle.

 

On the subsidy front, it's the customer who receives the subsidy; and again it's similar rational as before.  They are trying to get people to move to EV's, yet they create subsidies for classes of vehicles that just doesn't make sense.

 

 

It also doesn't waste resources, adding higher kWh means it should be able to be driven more miles overall...so in theory there is still the benefit of not having to replace your battery for a longer period of time.  It's also not a waste if the majority of people end up purchasing it.  For example, not being able to necessarily justifying spending $60,000 on a vehicle but instead you could afford $55,000 at the time...then later a year or two down the road spending a bit more for effectively an upgrade.

 

Saying hardware shouldn't be paywalled is only looking at it from a strictly black and white issue.  It ignores many many different factors; and cost analysis.

 

The acceleration is a good example of this, the hardware is capable of it...its just software limited...but the reason it's not done is that it degrades the battery more.  So the cost essentially offsets the additional warranty cost.

 

Or for heated seats for example.  If by installing heated seats in all vehicles, it introduces a cost of lets say an additional $50 (cost comes from additional hardware, but savings on only one SKU).  Then you sell heated seats for $200...you only need to sell it to 25% of people to make up for those cost of installing in all cars.  Any % more than 25 would be profits...and you know a certain amount of people would end up purchasing it after the fact.  (Seriously, I'm in the boat of owning a vehicle without heated seats where I wish I purchased a vehicle with one...it costs too much to add it in now though as it effectively needs to remove the seats).  Then consider the situation where you sell 2 SKU's...for heated seats you now need to increase the price initially because the cost will be higher to maintain 2 SKU's...base model costs would also rise slightly due to handling multiple SKU's.  You now have people in my situation that want heated seats but doesn't want to drop a thousand to have them installed.  Overall it's beneficial to lock off heated seats as it in general works out best for everyone economically.  While it is pretty made up numbers in this paragraph, it's actually a real thing that happens and something that is important to consider.

[HenrySalayne]

1 hour ago, wanderingfool2 said:

It also doesn't waste resources, adding higher kWh means it should be able to be driven more miles overall...so in theory there is still the benefit of not having to replace your battery for a longer period of time.  It's also not a waste if the majority of people end up purchasing it.  For example, not being able to necessarily justifying spending $60,000 on a vehicle but instead you could afford $55,000 at the time...then later a year or two down the road spending a bit more for effectively an upgrade.

 

Saying hardware shouldn't be paywalled is only looking at it from a strictly black and white issue.  It ignores many many different factors; and cost analysis.

 

The acceleration is a good example of this, the hardware is capable of it...its just software limited...but the reason it's not done is that it degrades the battery more.  So the cost essentially offsets the additional warranty cost.

It's sad we don't live in a fantasy world.

Every kWh will add about 10 kg of weight and $150 of BOM costs to the vehicle. The additional weight also reduces the range and adds to the energy consumption.

You can twist it as much as you like, but it is a waste of resources. Just like large batteries in general if you don't use the capacity (most EV owners only use a fraction of the capacity).

 

The same is true for the engines, which are bigger and heavier than they need to be.

 

Imagine the outcry if every Golf 4 would have come with the 2.8L V6 and they would just disable 2 or 3 cylinders for the lower-end models. What a waste of resources and money. But with EVs it's now excusable and a benefit for the customer. No, thanks.

 

[jagdtigger]

On 8/6/2023 at 8:22 AM, MSMSMSM said:

then start bricking the devices remotely through ban waves

The car is not their property so they cannot.

[MSMSMSM]

1 hour ago, jagdtigger said:

The car is not their property so they cannot.

 

I did specify that by brick, I meant preventing you from using online services that the device's functionality hinges on, not total hardware disablement.

 

On 8/6/2023 at 11:52 AM, MSMSMSM said:

ban waves (ToS violations prohibiting you from using online services... and your device is useless without said online services)

 

The car is your property, the software on that car isn't, the software is licensed to you as a matter of having purchased that vehicle but it still isn't yours (for example, you own the Macbook but you have a license for macOS, you don't own macOS, simply a license for it and are bound* by it).

 

If there is statue/case law/regulations that prohibit the revocation of software needed for the owned hardware to be used effectively, then you are correct, they cannot do that.

 

But AFAIK, that isn't the case in most jurisdictions. Tesla can (whether they should is a whole different thing) revoke the license to use the software and disable it. This renders the hardware effectively bricked (though not absolutely bricked, I suspect that would get you legal trouble, for example, with Sonos' attempt at remote bricking "legacy" devices) though physically it is unviolated (think about how Sony can blacklist PlayStation devices from accessing PSN, which prevents the console unit from engaging in substantial functionality)

 

If Tesla were to flash firmware that sabotaged that hardware, that can be criminal as it physically damages your car or if they attempt to disable core firmware that prevents the device from even starting at all or from driving, that would be diminishing the core ability of the hardware (i.e. absolute bricking).

 

I'd suspect effective bricking would be in the legal clear unless regulators/legislators/courts wise up. I'd imagine it would be positioned as value-added/non-essential services (even though they are taken for granted as requirements in a modern vehicle) like maps, connection to your device, apps, service integrations and Tesla-specific shticks like assisted driving, etc.

 

* - The legal enforceability of EULAs (End User License Agreements) are a legal grey area

 

---

 

I would love to be proven wrong. If anyone knows existing legal cases that do not support this line of argument, I'd want to know them. It's this control being moved away from immutable mechanics (can't firmware update a physical lock now, can you?) to software is why I've stayed as far away from smart devices as possible.

 

The push to always-online, cloud services and subscription fees makes me more disillusioned about the future of consumer electronics and things that are being made into consumer electronics even though they really are best left alone.

 

It's kind of depressing, I want a dumb EV, something built upon solid interiors and design but doesn't try to do any more tech than it has to. No custom "experience", give Android Auto/CarPlay and if not that, just give me a stereo slot and a place to mount my phone, I'll install something with Bluetooth and an aux jack, then let my phone do the maps and the music.

 

Don't be a tech company, be a car company and just give me a car that doesn't suck and is completely mine (in letter and spirit) and doesn't phone home.

[wanderingfool2]

6 hours ago, HenrySalayne said:

It's sad we don't live in a fantasy world.

Every kWh will add about 10 kg of weight and $150 of BOM costs to the vehicle. The additional weight also reduces the range and adds to the energy consumption.

You can twist it as much as you like, but it is a waste of resources. Just like large batteries in general if you don't use the capacity (most EV owners only use a fraction of the capacity).

What I said was truths though...no point in being ignorant to all the factors that affect costs of builds.

 

First addressing weight, weight isn't nearly as big as it is in ICE vehicles.  Regenerative braking recovers quite a bit of the energy lost accelerating it; and a lot of the weight also is in regards to protecting the batteries.  Tesla for example had a 62 kWh battery and a 54 kWh variant (delta 8 kWh).  Weight different 27 kg...depending on the cell type it's anywhere from 2 - 3.5 kg typically per kWh

 

Also, you are living in a fantasy world if you think Tesla pays $150/kWh.  Current costs are actually lower than $100/kWh per cell.  (Cannot use the pack/kwh because the pack cost without batteries pretty much is a fixed cost...more cells = cheaper pack cost/kWh without cells).

 

Again, maintaining different SKU's can be a costly endeavor (especially when talking about something like battery packs, which means you have to cut one line of manufacturing to keep the lower cost variant going)....and especially when they were limited by manufacturing speed.

 

It's also not a waste of resources, like I said if you limit yourself to 50 kWh lets say but have a 54 kWh battery pack it will degrade slower than if you had a 50 kWh pack.

 

Do you also not understand that it lowers the cost of entry as well?  They know a lot of people will eventually end up purchasing the range upgrade; but this way they can keep the base model at a lower price.

[StDragon]

4 hours ago, jagdtigger said:

The car is not their property so they cannot.

Unless you own the Title to the vehicle, technically it's not yours either (the lender/bank is the holder until the loan is paid off). So there could be some interesting agreements between the lender and Tesla.

That said however, at minimum they would void the warranty for tampering of the computer. Effectively you own a vehicle (title holder really) from a vendor that has has forever shunned you. YOYO (You're On Your Own).

[HenrySalayne]

1 hour ago, wanderingfool2 said:

depending on the cell type it's anywhere from 2 - 3.5 kg typically per kWh

Sure. Something with a specific energy density (raw, just the cell) of 100 - 250 Wh/kg will surely deliver 1 kWh with 2 kg weight...

It's Tesla, so it must be at least twice as good as physically possible...

 

https://en.wikipedia.org/wiki/Lithium-ion_battery

 

1 hour ago, wanderingfool2 said:

Also, you are living in a fantasy world if you think Tesla pays $150/kWh.  Current costs are actually lower than $100/kWh per cell.  (Cannot use the pack/kwh because the pack cost without batteries pretty much is a fixed cost...more cells = cheaper pack cost/kWh without cells).

https://www.energy.gov/eere/vehicles/articles/fotw-1272-january-9-2023-electric-vehicle-battery-pack-costs-2022-are-nearly

 

Maybe we talk again if you are not making delusional claims.

Even one of your favourite companies cannot change the basic rules of engineering.

 

 

[Shreyas1]

On 8/6/2023 at 1:36 AM, HenrySalayne said:

Which features are even software-locked in a Tesla?

Heaters? Battery capacity? Performance? Windshield wipers? Driving assist features?

Autopilot/self driving and performance are the main ones 

[Radium_Angel]

On 8/5/2023 at 11:08 PM, Crunchy Dragon said:

"you wouldn't download a car"

I absolutely would!

[WolframaticAlpha]

14 hours ago, HenrySalayne said:

Ahh, yes, the positives you find are tax evasion or scrounging some subsidies.

 

They are actually wasting resources to build extra battery capacity in every car to extort additional money from customers at a later point. That's not a benefit.

 

Hardware should not be paywalled.

It is insane how automakers went from making really nice and good cars to shitty subscription lootboxes in a matter of a few years. Buy a car from 2015-2016, and they will still have physical buttons, standard placement of driver controls, and most importantly all th features you paid for. It is almost ridiculous how fast they fucked everything up and I blame BMW and Tesla for this stupid bullshit.

 

[WolframaticAlpha]

12 hours ago, wanderingfool2 said:

reason it's not done is that it degrades the battery more.  So the cost essentially offsets the additional warranty cost

Wait a minute, explain it to me. In what universe does paying money for unlocking features that may reduce the lifespan of a vehicle lead to an offset in additional cost?

 

12 hours ago, wanderingfool2 said:

justifying spending $60,000 on a vehicle

Wait, but the feature is already present though in the hardware? If the customer is paying extra, that is a surcharge, not a charge to add to the cost of the materials of the vehicle, right? Since the feature is already present?

12 hours ago, wanderingfool2 said:

for heated seats for example.

Or, as we had build to order before? Most car companies typically have these options as build to order? Or in case you have very common features which come as standard, or come as standard in higher tier models. Maintaining and building multiple tiers is a business expense, and most car companies absorb these costs.

[jagdtigger]

13 hours ago, StDragon said:

Unless you own the Title to the vehicle, technically it's not yours either (the lender/bank is the holder until the loan is paid off). So there could be some interesting agreements between the lender and Tesla.

I do not think that agreement would be legally binding because it undermines the idea of ownership....

 

16 hours ago, MSMSMSM said:

did specify that by brick, I meant preventing you from using online services that the device's functionality hinges on, not total hardware disablement.

Thats not a brick......

[Kisai]

20 hours ago, StDragon said:

Unless you own the Title to the vehicle, technically it's not yours either (the lender/bank is the holder until the loan is paid off). So there could be some interesting agreements between the lender and Tesla.

That said however, at minimum they would void the warranty for tampering of the computer. Effectively you own a vehicle (title holder really) from a vendor that has has forever shunned you. YOYO (You're On Your Own).

And then when you sell the car, or make a business of buying used cars, "unlocking" them and flipping them, suddenly the manufacturer has a pile of angry car owners giving them 1 star reviews.

https://electrek.co/2022/07/26/tesla-ransom-customer-over-80-miles-battery-range/

 

It's happened before.