Hacking Tesla’s MCU-Z: A Breakdown of New AMD-Based Vulnerabilities
Tesla’s electric vehicles, through their MCU (Multimedia Control Unit), have utilized all three major tech components, starting from the earliest NVIDIA Tegra, to Intel Atom, and then to the latest AMD-based infotainment systems (MCU-Z). This has resulted in a significant enhancement in performance, allowing even the playing of Steam games inside the vehicle. However, Tesla’s custom AMD chip now faces a substantial security issue, having been recently “jailbroken” by a hacker team, potentially unlocking certain paid features.
It is widely known that Tesla’s electric vehicles, despite differentiating between high and low configurations, often include hardware for many features even in lower-tier models, with only software restricting their use. Owners can later purchase and activate these functions as needed. This software lock leaves room for possible breaches. A hacker team from TU Berlin in Germany discovered that by injecting voltage faults, they could successfully unlock the TPM key of Tesla’s AMD Ryzen SoC, thus accessing the MCU to modify functionality limitations.
It is reported that some Tesla vehicles can unlock specific paid features after being hacked. For instance, the 2021 Model 3 SR+ can enable steering wheel and seat heating through hacking, an enhancement otherwise costing $300. Additionally, the Model Y Long Range version can access an acceleration boost, usually a $2,000 feature, cutting its 0-100 km/h acceleration time from 4.8 seconds to 4.2 seconds. However, it is worth noting that not all paid features can currently be activated.
Apart from unlocking paid features, this vulnerability could also be exploited to access the owner’s private data, such as their phone book and calendar—personal information at risk due to a hardware flaw in the AMD Ryzen SoC. Consequently, Tesla cannot patch this vulnerability through software upgrades, similar to the Nintendo Switch hack. However, since this operation would disrupt the vehicle’s unique hardware-bound key, it may fail verification through Tesla’s network services, such as Supercharge stations, possibly resulting in a refusal of charging.
This practice of firmware flashing to enable hidden features is not exclusive to Tesla. For example, some BMW models have long had the capability to modify the M-power dashboard and enable CarPlay, among other minor functionalities. Though the MCU and vehicle computer operate as two separate systems, theoretically not interfering with the vehicle’s operation, these unverified modifications could potentially lead to a loss of factory warranty. The risk level, therefore, is not as trivial as flashing a mobile phone.
