13 ms·
Pretty sophisticated attack vector: low voltage attack on AMD secure execution environment during boot. I wonder how many tries you need to get whatever bits yo
by vessenes 3y ago
Pretty sophisticated attack vector: low voltage attack on AMD secure execution environment during boot. I wonder how many tries you need to get whatever bits you need in the right place. Also, I imagine you only need to cut 12V wires to do this, but I admire the willingness to get in there direct on these systems. I'd be a little nervous to make those cuts personally.
Buried in the article is the claim that this will let them pull the RSA private key the car owns out for other uses -- while this is likely to remain a very niche attack vector, that's got to be really bad news for someone in vehicle security at Tesla. On the other hand, post jailbreak you could anonymize your location on Tesla's servers, which would be nice.
- judge2020 3y agoAnonymizing your location - until you put in route and your car asks for traffic information from teslas servers.
- d4l3k 3y agoIf the map can't talk to Tesla it'll use Google maps directly. I usually don't allow connections to Tesla on my rooted Model 3
- zoover2020 3y agoHoe did you root yours? Did you lose out on any functionality?
- d4l3k 3y agoThere's some functionality loss but it's mostly been mitigated. I have a custom app I wrote since I can't use the stock app. The one feature I miss is that there's no voice commands since that requires Tesla's servers but at the same time I also haven't been bothered enough to plug in a custom backend
- lrem 3y agowait So the company that goes "we don't need physical buttons since we have voice commands" also goes "you don't need those in underground parkings"?!
- majikandy 3y agoIt’s ok, the voice commands are barely understood anyway. At least in the UK they aren’t. Gets it drastically wrong and messes up your navigation destination, because you asked it to open the glovebox “navigating to Columbia”
- adamgamble 3y agoI also would like to subscribe to your newsletter.
- d4l3k 3y agoI've got a blog if you're interested haha https://fn.lc/post/ https://fn.lc/post/ I've been hacking on my car and creating my own self driving models Code is at https://github.com/d4l3k/torchdrive https://github.com/d4l3k/torchdrive
- seanthemon 3y agoVery cool, am going to eat this up. FYI some of your images won't load for me, shoots me a 502 here https://fn.lc/post/diy-self-driving/ https://fn.lc/post/diy-self-driving/
- d4l3k 3y agoNot sure why they aren't loading, seem to be fine now They're also at https://github.com/d4l3k/fn.lc/tree/master/static%2Fdiy-self-driving https://github.com/d4l3k/fn.lc/tree/master/static%2Fdiy-self...
- acer589 3y agoIs that legal?
- kortilla 3y agoIs getting married at 15 in Georgia?
- malwrar 3y agoHow does this work with their charging network? Are you still able to use their chargers, or are you stuck with home charging & third parties?
- d4l3k 3y agoSupercharger auth is between the car and the charger and doesn't require an internet connection. I get billed the normal way via my Tesla account since the VIN is registered
- wholinator2 3y agoOh no, don't give them ideas. It'll become the HP instant ink of car charging
- nikau 3y agoYour L2 charging wire is low on copper, please replace the entire cable.
- judge2020 3y agoAre there api keys for google maps in the car? Or does it emulate some client like a browser or android phone?
- FirmwareBurner 3y ago>that's got to be really bad news for someone in vehicle security at Tesla. It says in the article: "Generally, these exploits are shared with Tesla, and it helps the automaker secure its systems." So it's only a matter of time till Tesla patches it.
- capableweb 3y agoMore relevant quotes from the article: > The group of hackers claims that their “Tesla Jailbreak” is “unpatchable” and allows to run “arbitrary software on the infotainment.” And the full quote of what you put: > Electrek’s Take > Generally, these exploits are shared with Tesla, and it helps the automaker secure its systems. > In this case, the hackers said that despite the exploit, they believe Tesla’s security is better than other automakers. Doesn't seem like the security researchers actually shared the exploit with Tesla, at least as far as I understand.
- kelnos 3y agoThe information in this article alone is likely enough for some Tesla engineers to sit down and figure out the exploit themselves. And if this research group wants to enable regular people to "jailbreak" their cars, they have to publish their full methodology anyway.
- vorticalbox 3y agoThat's likely because it's a hardware issue, nothing really for tesla to do.
- striking 3y ago> I wonder how many tries you need to get whatever bits you need in the right place. For the Xbox 360, the "Reset Glitch Hack" (which worked similarly) would just try over and over again until it got it right. A computer is happy to try tens or hundreds of times on your behalf.
- jsheard 3y agoHowever the next Xbox added active countermeasures against glitching attacks which force a reboot if the clocks, temperatures or voltages go outside of reasonable bounds, and that's never been defeated. Glitching attacks can be very powerful, but they have a limited shelf life if the hardware manufacturer cares to prevent them. https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo
- striking 3y agoDefinitely. Not arguing that this can't be fixed, but rather outlining how a similar successful attack was made more reproducible.
- mgiampapa 3y agoJust like we used to have cable box guys willing to sell you an unlocked box for premium channels, we are eventually going to have feature unlock guys that you go do and for a small fee perform some slightly more technical hack to enable features that are already there.
- technothrasher 3y agoThis market already exists for things like enabling Navigation on VW/Audi cars. People were offering to enable the hidden Android Auto support on my Porsche Macan for $600, which I almost went for until I found the scripts and instructions to do it myself.
- jxf 3y agoHidden as in it's not available normally, or hidden as in it's a paid feature?
- avree 3y agoIt was built, and then disabled, as Porsche wasn't comfortable with Google's policies around data collection from Android Auto. You can pretty easily figure out how to turn it back on.
- mgiampapa 3y agoI did the same on a Mazda CX5 a few years back, but it was a software only hack to get root first. I suspect the actual physical hardware modification line is the one that most users are going to be unwilling to cross unless they are in the "Download a Car" crowd.
- harshalizee 3y agoDoesn't the Mazda CX-5s all ship with Android Auto and Apple Carplay by default?
- 3y ago
- klysm 3y agoI don’t understand how you can defend against low voltage attacks like this.
- jsheard 3y agoThe Xbox 360 was broken by voltage glitching, and Microsoft successfully prevented it from happening again with the Xbox One: https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo In short, there's now a hardware watchdog which reboots the system if anything weird happens to the clocks/temps/voltages, and they carefully structured their boot ROM (the only code they can't patch later) to ensure that even if you somehow manage to sneak one glitch past the watchdog, no single branch condition being inverted will lead to a compromised state.
- 14 3y agoThat is really cool. I personally installed the reset glitch hack on several Xbox 360. Immediately thought about that when seeing this article on the Tesla
- weebull 3y agoMake sure all security critical state is initialised to known values at reset, then have very tight tolerances on your power watchdog to initiate reset. However, that doesn't make for a stable system when powered from batteries.
- ddalex 3y ago> you could anonymize your location on Tesla's servers I already anonymise my location on Tesla's servers by simply not owning a Tesla
- moffkalast 3y agoAh, but where's the challenge in that?
- coolspot 3y agoYour car is filmed and recognized by other teslas.
- closewith 3y agoThat can't be legal? Not in the EU, anyway.
- ballenf 3y agoAre you saying dash cams are illegal broadly there?
- closewith 3y agoDash cams are much more tightly regulated in the EU than elsewhere (you become a Data Processor and have all the responsibilities that comes with that). Private ANPR in public spaces is unlawful in I think every EU state?
- liber8 3y agoComing from an American perspective (where, when you are in public, you have basically no expectation of privacy), this seems insane. Does this mean that if I'm filming a vlog at Brandenburg Gate (which inevitably includes video of other people in the background enjoying the area), I'm in violation of privacy laws? Does that mean if I take a video selfie of me and my family members (which, again, includes images of others in the background, and which is automatically uploaded to icloud) I'm a data processor and am in violation of privacy laws? I assume there is some line here, but I can't think of the logic separating a person's dashcam from my examples?
- brewtide 3y agoSemi related question I suppose. Do the Teslas simply use GPS for their location information? If so, couldn't one spoof the GPS using a hackRF or similar?
- ballenf 3y agoTargeted by the FCC seems worse than violating a Tesla clickwrap agreement.
- myself248 3y agoOnly an idiot would let their GPS spoofer onto the air. You unplug the antenna cables from the receiver and pipe the spoof signal in there.
- comboy 3y agoI have no idea about Tesla specifically but normally you'd also you cell and wifi information (in their case probably also information from other teslas around) and additionally you have accelerometer and the whole "self-driving" computer to estimate where the car is and where it's going. It's also a known attack vector and likely covered because GPS signal is really weak so it's easy for somebody outside the car to try to make a mess.
- suction 3y ago[dead]
- bushbaba 3y agoIsn’t this a huge risk to AMD’s confidential compute offering. It’s a major security flaw.
- kccqzy 3y agoI have reviewed the threat model carefully before. AMD never claims that their confidential compute offering is immune to attacks involving physical access. I assume what you mean by confidential compute is technology like AMD SEV SNP? Those are very different in that they allow you to run a trusted virtual machine on an untrusted hypervisor. This attack is completely different; it's akin to breaking Secure Boot on a PC.
- closewith 3y agoCan you not turn off vehicle tracking?
- speedgoose 3y agoSince a few weeks you get a classic consent screen for various categories of tracking. At least in Norway. You can turn everything off but I think some data is still sent to your phone through the Tesla servers. And I assume it’s not end 2 end encrypted.
- bastardoperator 3y agoDefinitely sophisticated, but something console hackers have been doing for quite some time now including the boot flow. I'm wondering if a Tesla vehicle/computer is more sophisticated than say a PS5?
- dhx 3y agoThis is the same attack (and same people who developed) faulTPM[1] that was previously discussed[2]. This article is the same people demonstrating that attack against Tesla vehicles. The paper[1] and previous discussion[2] address the underlying problems with AMD's Secure Processor (AMD-SP) that is embedded in their CPU SoCs and previously and more commonly known as Platform Security Processor (AMD-PSP). Unlike a web browser where W3C AntiFraudCG folk propose that websites would blacklist all impacted AMD-SP hardware and create massive amounts of e-waste[3], Tesla likely can't do much about this attack because Tesla (not users) would be responsible for a very expensive change of vehicle hardware. If it's not an easy-to-execute attack like faulTPM, there are more complex (but becoming more mainstream and cheaper) IC reverse engineering methods like polishing the die down to take photos of each metal layer and regenerating VHDL, FIB editing an operational IC to bypass tamper detection methods, etc[4]. A security architect of the Xbox One presented a talk[5] a few years ago which provides some good background too. Largely the Xbox One has managed to avoid piracy because they made it economically not worth anyone's time to attack due to competitive pricing models versus high cost of attack. Similar to use of Denuvo for a month or two after release of a PC game, attackers aren't going to bother if their work amounts to nothing a month later. Hacking a Tesla to enable additional features is worth a lot of money, so the economics are quite different. It's also different economics for printer cartridges, "pay to enable more features or performance" network equipment, etc. The cost of IC reverse engineering / FIB editing attacks (or other future attack methods) will keep reducing. IC tamper detection features will get more complex. Perhaps attackers will even get an advantage once they can readily reverse engineer 3nm ICs and defenders can't do much other than implementing ever more complex and obfuscated IC tamper detection features and VHDL logic (kind of like a Denuvo situation in hardware). [1] https://arxiv.org/abs/2304.14717 https://arxiv.org/abs/2304.14717 [2] https://news.ycombinator.com/item?id=35787195 https://news.ycombinator.com/item?id=35787195 [3] https://github.com/antifraudcg/proposals/issues/19 https://github.com/antifraudcg/proposals/issues/19 [4] https://www.youtube.com/watch?v=6390Zqca3Mg https://www.youtube.com/watch?v=6390Zqca3Mg [5] https://www.youtube.com/watch?v=U7VwtOrwceo https://www.youtube.com/watch?v=U7VwtOrwceo