Jailbreaking an Electric Vehicle in 2023 or What It Means to Hotwire Tesla's x86-Based Seat Heater

Explore the latest jailbreaking technique for Tesla's x86-based Seat Heater, exploiting vulnerabilities in the AMD-based security processor for arbitrary code execution, root access, and sensitive information extraction.

Key takeaways
  • The speaker describes a method to jailbreak an electric vehicle, specifically a Tesla, by exploiting vulnerabilities in the AMD-based security processor.
  • The method involves injecting a fault into the processor to accept a custom root key, allowing for arbitrary code execution and gaining access to the root file system.
  • The custom root key is used to patch the boot stages and enable the loading of custom code.
  • The process involves using a Teensy microcontroller to glitch the AMD secure processor, allowing for the injection of custom code and the extraction of sensitive information.
  • The method can be used to extract car credentials, disk encryption keys, and other sensitive information.
  • The speaker notes that this method is not persistent and requires repeated attempts to succeed.
  • The talk also covers the use of Trusted Platform Modules (TPMs) and how they can be exploited to gain access to sensitive information.
  • The speaker provides details on the process of extracting the car credentials and disk encryption keys, as well as the use of a custom root key to patch the boot stages.
  • The method is demonstrated to be successful in practice, with the speaker showing how to extract sensitive information and gain access to the root file system.
  • The talk concludes by highlighting the importance of maintaining confidentiality and integrity in the development and deployment of secure systems.