Patrick Kiley (GXPN, GPEN, GAWN, GCIH, CISSP, MCSE) has more than 18 years of information security experience working with both private sector employers and the Department of Energy/National Nuclear Security Administration (NNSA). While he was with the NNSA he built the NNSA’s SOC and spent several years working for emergency teams. Kiley has performed research in avionics security and Internet-connected transportation platforms. Kiley has experience in all aspects of penetration testing, security engineering, hardware hacking, IoT, autonomous vehicles, and CAN bus.View the profile
About the talk
Patrick Kiley, Principal Security Consultant, Rapid7 Tesla has a history of increasing power available to its vehicles after they are released to the public. This talk will cover the technical details of the addition of Ludicrous speed to a Model S and cover the process, security model, and additional measures a manufacturer can implement to make such a 3rd party upgrade more difficult.
Hi there, welcome to my RCA talk, the video security model of the Tesla Candice and Battery management system. On my name is surti consultant-led to rapid7 go through. This is a critical research. I did on on a vehicle that our table. And I hope you enjoy it will be tomorrow at the end. I just sent this is a pre-recorded talk. You're welcome to ask questions during all the following during the actual presentation was trying to answer them as best I can do in the car. Dion. I want to go through want to talk a little bit about the, the
architecture of the Tesla Model S and some of the security components that are relevant to it, as well as my journey text to do the upgrade and add additional to it. So, a couple of big Target for the hacking Community. This is a picture taken at the car hacking Village at Defcon a couple years ago, but they are also a very proactive security company that God damn good bug Bounty program. It's just a case against a quest with big price. Original one that that test will that I actually did the work on at the soc, the main display that you see on
the Right In His Image on, it actually has a hardware level law that was at the same one that affected in tendo switch. So that there is the one that allowed there to do in order to be updated and and an action. That's one of the big reasons that a dude and move to the Intel anime CPUs on that the newer car for model 3, in the near accident. Do the topics to cover on this. We're going to go over the architecture while we're going to talk about the the process of the Lucas upgrade. Do some firmer analysis, cover
logical Security on a BMX board and then go deep into the can bus uniform diagnostic issues that mainly kind of meat of a talk and then follow the recommendations. A final note. For the original model Assets in a bun to base Linux system the autopilot to see in the in the picture of the version 3 newer, likely all Tesla, silicon earlier versions were on the Nvidia based. I actually has an Ethernet connection between the instrument cluster and the central display though, the one to
find me out in the previous image, but then there's a security Gateway that exists between the ethernet bosses are all the the Bluetooth The Cellular Connection and the other individual vehicle control. So this is pretty important, part of the system overall system. It's between are the Tegra SOC in. The berries, can buses are trained chassis and body, but it's also heavily involved in that. They process a new software for the vehicle, though. The Gateway is a
major part of that update process and it's the one that actually handled the updating of all the individual are in Connected modules on the vehicle itself. And really think about the security Gateway is that actually stores the configuration of the vehicle as a text file. Now, newer versions of of this file actually have protections that prevents anyone from changing an older versions of software. All you have to do is based off the Gateway, Mason edits, and then upload it back in. Answer, for example, you can you
can turn on supercharging. That's how I disabled it on salvage vehicles. And as well as control on the level of Auto 5 is actually purchased. So there's a lot of relevant and significant changes that you can actually make that file to do that work. So the battery management system itself is a d f, t t. I t m s 320 that runs its own version of software. Linux, a surge in the back up to it to the cpld. That's the also exists alongside the the GI unit that acid accident or Hardware, backup other. The current time.
Molesting them. That's an important device that actually measures the amount of current coming to me battery through a very, very small resistor are very low value is a sister that is used to prevent damage to the contact that. Also could do you yesterday? Here's a good image, that actually shows all those individual components. You can see the shot with the large bus bars,, and then there's a small known resistance and I just measured the voltage difference between the two of those wires, a simple B&B voltage sensor connectors, that actually
connect to the contactors. There's a positive and negative contact her and said the battery pack. And a couple other components. So, how does the ludicrous upgrade process work? How did I do that? What happened? Was that the p d v d was released and then a ludicrous was there at the peak for the PewDiePie be with an aftermarket upgrades over. And after purchase upgrades though. The car was around the car was released for several months. And then they announced it had a half a second to the 0-60 0 to 60
time and it was a $5,000 retrofit or $2,000 on you purchase that to the standard feature and then claims that the Plaid model of a certain window. After a couple of years. It was no longer possible to get a ludicrous upgrade on an existing TV party. So I took upon the goal to actually reverse-engineer that process. I figured it. Actually, I was available my service centers. I might actually be able to figure it out and I turned out really complicated my friend on. I
want to be happy for him. Since I got in touch with me you want me. I used to drive for the weekend, Tom and then I get the title Contender. So what I had to do is drop that battery pack, replace the pyrofuse, which is a safety mechanism had to replace my contactors. I need to modify the time, but I also had to do four more changes. That means to do with the vehicle covered in the thing. I recalibrate the hydrant shunt earlier. And then once I was done with the
entire process, they managed to break the vehicle. Am I couldn't drive it back from California. I had to go. Here's a picture of the fuse on the last in the eye contacts. Are they on the right with the old contacts removed or cold water for doing this? And that these words that have to buy some high voltage gloves over there, but then you 12 4 textures. So even though everything is isolated. You can still get yourself up quite a bit nasty shock. So there's a protocol that you have to follow
you. When I get charged the battery down probably 15 or lower course and Phillips both. So I removed from the other side and then now after is all done and I did do some isolation testing. Why? What you basically, making sure that there wasn't anything up. What I was actually able to do during all this process is actually fear on the farm. Where were actually works on the model. So are within the same to you within the other, in a bunch of a system. There are a series of folders that actually store all the firmware for all the various modules and of modules on the table. So
we have that at the Tegra 3. That's the space between arm cortex Esteban to wash my house with them. But if you can extract that from the system itself, get to those deployed rectory and you can actually see all the various ask for more components in there. And then the Gateway itself has files that identify the vehicle firmer and configurations over Hardware IDs. Actually identify all the various models butt on the vehicle and firmware. Darcy is the one that are control. Basically has all of the current. All those Nest thermostats
will be running on the vehicle itself for the revision number. So, we have on a hardware ID and then a revision number and Darcy filed with the one that I actually got messed up during my week. Recovery process. I had to manually rebuild back for the other PMS. Are you still in the DMS? Former change? Its former female you changed, I had to recalculate to CRC back to the Gateway in there, not away with the car back up. Do the structure in a file? It actually shows you. Okay. So here's the module and she was
like the signature value of the of the farmer itself. And that uses just actually build the serc values format. Individual module on a vehicle and so once they extracted that out figured out the correct form where there was supposed to be on the EMS unit. I calculate the correct year. So you just have the file name that fits the login. What is the individual files? How they are the store? What is that actually look like in ears. A single line from one of the X-Files from the battery manager, informed the
other until X-Files or send line with the Forum at work. So first we have a colon is a delimiter. We have the size on a dress and memory where it goes record type and then we actually have the data and then a small one, my check stub. So I can become important later when we get into it further. So, one of the things I actually wanted to look at when I was big into this and how well protected is the DNS for to self. So when I got a few of these, I was experimenting around on a test bench before, I was actually trying this pain
while production one will be able to actually drive to actually figure out this process. Before I, I tried this. I thought I had everything figured out. But if that's your thing, that's one of the things that I was on an earlier BMS that I I purchase there. Is this better. Perfectly mirrored. The debugging connector used by Texas Instruments for the Tian S320. So that was a nice things, like wonder if I can actually connect H. I can do anything. Audio thing I did was download the data sheet for the tms320 and identify where the object was checked. And there's a
security password. Under 28 - word. Lasso, not really easily decibel, but let's see if we can find it in somewhere. While we can see that it's stored at the seven ff8. It is actually look in the address portion of this guy to see if I can actually find the seven ff8 know. We have the code entry point at 7 after 6 with 7 SI Satan's, not actually in there. But the CRC value was I was well, what about the boob or so during the ludicrous upgrade process? I figured out, I actually
had to replace the blower motor and all the bootloader firmware is stored inside python source of the toolbox executed toolbox has a diagnostic app. Concession used by Tesla to fix the vehicles that are full of various issues than one of the things that I can actually do really well, if you have those apartment virgin, you can actually a flash individual units with that. There is certain to fahrmeier, but their toolbox iPhone Source. Are they actually able to decrypt in now
actually described the entire Ludacris upgrade process using that? In one of the other two, it will call you in a little bit and tell her I was actually able to update the bootloader. Can you get Flash from where I'm at? So I'll look at the bootloader. Let's see if I can find a 7s at 8 and we did accept it. Value. 10TV. I t, i n a flash program and we actually a market. And for some reason half an hour to figure out if they took the keys backwards and you actually are able to unlock,
we are here next week. So she's able to do a full memory dump of that and then importing Ida which actually supports the processor that Here we have seven sf61 to the code entry point for those of you. Actually Denver's engineering Farmington entry point. Since I'm going to be a challenge. Then I manually than what you actually have to do is manually, figure out the Assembly Language. That's the full thing of corned, actually running out to be a master. Lol. What did they take away from that? I disable JTAG all together or not
really sure if you see 2000 series DSP but having that JTAG password and a piece of code that, you know, something is your service center. It's more likely to fall into third. I need some people. I got a hold of that. They were able to share with me. So I found it and really just want to get as much as possible because having something to eat open my card. Obviously allows people to do stuff wanting the vehicle for me. It is more of a canvas work on me at Walmart. So it's really just like any other bus for my you have a bunch
of them stated that gets updated regularly York and ID's with her also to an address, but there's not really a send and receive address unless you get into the higher-level. Protocols. Are you really just have a bunch of texts about you? Are but there is a doormat, right? We be putting those mats call Derek and databases and I was actually able to extract the DVC files from. So I need a vehicle. They have that file but there also and tool boxes will be easier to work with data and now we have to do today and they
didn't see there's a huge difference with all the way and all the signals to each other before u r g. I s t, i r the whole Drive inverter in the front drive inverter. Give me the BBC files as a direct label incorporated into Vehicles. Fly from here to able to work. Something out there to bother you. The Seattle Seahawks free version. I love you. Picture of the power curve and additional the one of the things that you need about the Tesla's in general, is the amount of power available
varies based on how hot the battery is at is charged. So Do with a ludicrous plus mode, what the car actually doesn't heat the battery pack up, beginning to an optimal temperature to actually give you the maximum amount of power. You can see there's a huge variance between the Genesis law on that Celsius state-of-charge. Fortunately, I wasn't able to get all of these variables today. I had to keep the battery pack up and then discharging his same time. But the smell your hand was around. 8 Celsius Celsius and 81
%, senior charged with 343 tall box, but it will charge and heated battery. We have all the way up to 482, roughly points, did not return 40. Horsepower sale on. This was after we can separate that. I actually mapped out this Parker. So one of the other things that you need to bow out, dumb idiot says there's a standard there are Protocols of thing on top of it. Yes. Is that is a part of us. I got the gun back and OBX is a standard for specifying files, that use the uniform Diagnostics standard to,
to actually do diagnostics, or with a 3lb canvas modules to do things, and see. When is 27, which brand security access? 10:31 routine control. Upload, download read memory on my table actually recover. All these are the X-Files also some toolbox, but the other way you can do as you can just connected cannabis snipper and capture the stated during an upgrade and then he killed it. So there are two canvas ideas that Define, I'm kind of send and receive and then
Space and died at about 4:30. If you actually look at the situation TV at 6 or 2 and 6:12, or I send and receive and this is the actual security access. 420 box itself itself. So all Tesla models and this is what I need is basically just X or what their value of 35. So you request a seed and then your response is the x or $35 you of it. Quite what to get for Fender. The seed is 0 0 0 1 0 2. 8 Center, all the way up to their self doesn't change. Its the same from every single vehicle.
Every single module. Throughout all the different firmware version. It's all static of the only thing that you could really do. They would be less. Just not used to carry access at all. Going. Here's an example of the actual read being 250, the key in the middle of the responsible thing. But It's not all bad news. So the reason they would allow us to do the same thing. You did using JTAG routine, 23, read security. My address that was actually disabled by I tested and under several different condition was not able to get any type of response
from the battery management. System actually read a memory using 23 Salem, walk down here until you walk down 14229, normal for you. And they're not the ones I actually was able to get a valid response from. Or when I found a valid value in the odf files are all the states in a year. So here's are really important on that that was not involved in being able to regain of ID, while routine. 22 actually read the calibration data for the print shop in New York City. I want to see a. You won't data using values also, so we did it by d-tent.
Are you going to actually put sound on camera? And then to recalibrate it, you actually bring the table of every single p85d, DNS extract. The one for the serial number, for the shunt Seether, through the 3.5 1007, and then you go through and actually write to me. Respond. That table too that shines as a part of the day would do I make it available on again. Here's the other interesting thing as we were able to reverse. This is how you upload movie in Esperanto course, if you just watch a
firmware upgrade was a car is actually picking new firmware to the car. You cannot capture all they're going to get upgraded right now for a while then Starts Now. First it erases, the old Flash and then it goes through and I request a download on this lyrics me somewhere over you. Yes, you do know that until I see you again. So, I can get the final thing. Works out. Fine. Old fox has sold with their friend of mine. Also, head of the car. I can go AJ, Rob Leo.
Do something other than ecstatic. She don't use that icky for both. Are the access down my modest or was it really as well? Go back to the manufacturer to actually write and Kris and Kendall system that you'd better. Wait and see if Titi architecture is exactly two factors that can we move to a PPI? They spoken. So what happens is if you have to do something really sensitive, like I remove miles from something else. That's a really simple game. That has a long history of token.
Based on something in the vehicle from Tina, Bayer built and then it'll just have a long expiration time. If you have to actually make that change. The other thing, you know, how much is standard hardware-based? Things are just your boobs while I'm at the store urechis. Surely within the device itself is a flash memory stored in The X-Files in value. So I started the process. We actually do all the transfers. It's not. Leave. The other routines open for normal. Diagnostic should be to see all this stuff and just in the media, Christine and then some
A process changes, don't throw the bootloader in the diagnostic. She sensitive security, password in, and out of there, have a Special K to show me there. Then. I'll have your engineering department Scandal of this investigation just account really, cracked open a case and will be just a large of an information on how bad the architectural system work, where and digging into the system itself. So it was a large amount of information over the oven cooking, at least preschool available for the software
that they have schools. And I diagnostic software for you in the can bus to our research Rob, Leo, for all the IDS and can it take me to get to understand? Thank you for letting me do is talk and a blessing. Everything. I was talking about here. Thank you to the team that I work. Now, if we are to watch, reverse engineering it buster. Here's a short little screen of some references on the still be available on the app actually access of later. And I just like to say, thank you for letting me do this talk and this presentation for RX8
Buy this talk
Buy this video
With ConferenceCast.tv, you get access to our library of the world's best conference talks.