#Researchers Hack a Tesla and Unlock Paid Feature Upgrades – Review Geek

Heated seats? Yes please!

A group of security researchers in Berlin managed to “hotwire” or hack a Tesla, enabling software features most customers have to pay for. While this isn’t your typical hack, cyber threats are a growing concern in the world of electric vehicles.

Instead of paying $300 for the Cold Weather package to unlock a heated steering wheel and rear seat heaters, the exploit allowed researchers to enable it for free. More importantly, it sounds like this hack is unpatchable by Tesla or AMD, who manufacturers the chipset used in Tesla’s MCU (Media Control Unit) targeted for the exploit.

According to the group, they used a voltage fault injection attack (or volt glitching). They managed to tweak the voltage and trick the AMD-powered MCU and infotainment system into giving them information from the TPM (Trusted Platform Module) security system.

In a statement to TechCrunch, the researchers said, “If we do it at the right moment, we can trick the CPU into doing something else. It has a hiccup, skips an instruction, and accepts our manipulated code. That’s basically what we do in a nutshell.”

Once the system accepted the changed code, the team turned on the heated seats package. It could potentially enable more costly software upgrades like enhanced auto-pilot or Tesla’s self-driving technology that costs owners an extra $15,000.

It’s important to note that this isn’t your average hack and requires hours of physical hands-on time with a Tesla. Basically, this isn’t something owners should worry about, as hackers can’t do it from a distance. Instead, it’s a problem Tesla will face if owners start trying to bypass its systems and unlock features typically hidden behind a paywall.

That said, there are potential issues with user data. The same hack gave the researchers access to the encryption key used to authenticate the vehicle on Tesla’s network. Not to mention personal information like Wi-Fi passwords, contacts, call logs, calendar info, and more from connected devices stored on the infotainment display.

The TU Berlin research team will present the findings on August 9th at the Blackhat hacker conference next week in Las Vegas. Who knows, maybe they’ll have FSD up and running by then.

via TechCrunch