Jailbreaking an Electric Vehicle in 2023 or What It Means to Hotwire Tesla's x86-Based Seat Heater
summary
Researchers bypass AMD platform secure boot on MCU-Z infotainment boards bought for about $400 on eBay, use voltage glitching (Teensy-driven SVI2 commands, three soldered wires to SPI/SVI2/CS) to skip root key checks, patch coreboot/VBoot checks and get a root shell, then extract the firmware TPM state and the chip‑unique seed to derive and unseal TPM objects including the car RSA credentials and disk keys. The rear seat‑heater flag is flipped and works, but the glitch is non‑persistent without hardware mods.
AI-written summary · about
chapters (16)
- 0:00Tesla security introduction
- 1:30Infotainment system layout
- 2:01Microcontroller analysis
- 3:43Previous Tesla attacks
- 5:17Boot security and trust
- 7:18Bypassing secure boot
- 9:28AMD secure processor
- 11:53Voltage glitching technique
- 14:43Glitching setup and tools
- 18:01Executing the attack
- 21:22Activating locked features
- 23:34Persistence and defense
- 25:22Extracting car secrets
- 28:12TPM hierarchy analysis
- 32:40Offline key derivation
- 37:17Final demonstration
related talks
40mUnlocking the Drive: Exploiting Tesla Model 3
44mMy Car, My Keys: Obtaining CAN Bus SecOC Signing Keys
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
39mGlitching AP4: A Technical Deep Dive Into Tesla’s Autopilot Computer
43mThe Tao of Hardware the Te of Implants
20mSecurity and Safety in the Modern Vehicles
41mPanel: Tackling Automotive Hardware Vulnerabilities
01h 06mBackdoors in Back Doors