The UDS Security Model of the Tesla CAN Bus and Battery Management System
summary
Reverse engineering reveals how the Ludicrous retrofit is delivered: physical surgery (replace pyro fuse, contactors, recalibrate current shunt) plus BMS firmware changes pushed over UDS on CAN using extracted ODX/DBC and Toolbox Python code. Capture shows a static seed is constant and Toolbox contains a JTAG key found in Toolbox enabling full TMS320 dump loaded into IDA. Power maps move 343 kW at cold to 482 kW (~647 hp) when heated; the retrofit shaves ~0.5 s 0–60 but also bricks a car if CRCs and files mismatch.
AI-written summary · about
chapters (24)
- 0:00RSAConference2021
- 1:00Tesla Security History
- 2:23Tesla Model S/X Architecture Overview
- 3:01Tesla Security Gateway
- 4:30BMS Overview
- 5:30BMS Components
- 6:08Ludicrous Announcement
- 6:48Ludicrous Upgrade Window Closed
- 7:31Adding Ludicrous Speed to a Dual Motor AWD Tesla
- 8:04High Voltage Surgery
- 8:17Safety First
- 9:12Tesla firmware updates
- 9:45Gateway files
- 12:15Different BMS board, earlier revision
- 13:24What about the bootloader?
- 15:12IDA Disassembly
- 16:43CAN Decoding
- 18:11BMS Power Curve
- 19:37ODX - Open Diagnostic eXchange
- 22:42UDS Routines Enumerated
- 23:14UDS Routines For Ludicrous Upgrade
- 25:50UDS Recommendations
- 27:56Process Changes
- 29:24References
related talks
37mAutomatic Automotive Hacking
43mElectric vehicle CAN man-in-the-middling
18mUnleashing the Power of My 20+ Years Old Car
40mD2T1 - Backdooring & Remotely Controlling Cars
44mMy Car, My Keys: Obtaining CAN Bus SecOC Signing Keys
19mSecurity Analysis of LTE Connectivity in Connected Cars: A Case Study of Tesla
32mNo cars were harmed for this talk: Automotive Rust, amateur style
41mJailbreaking an Electric Vehicle in 2023 or What It Means to Hotwire Tesla's x86-Based Seat Heater