Unlocking the Drive: Exploiting Tesla Model 3
summary
Research demonstrates a full chain against Tesla Model 3 infotainment and gateway: initial Bluetooth OBEX image overflow in the Qt car Bluetooth service yields an arbitrary write primitive via a custom heap allocator, HCI vendor commands turn that into a Wi‑Fi firmware DMA write to get code execution in the Wi‑Fi SoC, a bcmdhd driver bug plus kernel stack spray and a cache-based ASLR leak produce root on the infotainment, and a logic gateway updater signature bypass allows arbitrary CAN messages to ECUs; exploits are built, tested at the contest, and later patched.
AI-written summary · about
chapters (20)
- 0:00Tesla Model 3 security research
- 4:31Tesla architecture and hardware
- 8:30Bluetooth exploit entry
- 10:19Bluetooth music playback vuln
- 13:41OBEX heap overflow
- 17:29B Server code execution
- 18:14Sandbox limits
- 20:03Bluetooth firmware access
- 21:55WiFi chipset code injection
- 22:38BCMDHD driver exploit
- 24:04Kernel stack spraying ASLR bypass
- 25:49Kernel ASLR retrieval
- 27:18Stage one payload
- 28:03Security Gateway overview
- 30:08Time of check time of use bug in updater
- 31:54Signature bypass in gateway
- 33:25Secure boot bypass
- 34:29Full exploit chain summary
- 36:16Research outcomes and fixes
- 37:43Question and answer session
related talks
51m0-days & Mitigations: Roadways to Exploit and Secure Connected BMW Cars
41mPanel: Tackling Automotive Hardware Vulnerabilities
41mJailbreaking an Electric Vehicle in 2023 or What It Means to Hotwire Tesla's x86-Based Seat Heater
40mSecuring the Connected Car
51mSteering Clear of Danger: Decrypting the Realities of Remote Car Hacking
29mBackdooring of Real Time Automotive OS Devices
34mBack-connect to the Connected Car. Search for Vulnerabilities in the VW Electric Car.
40mPerfektBlue: Universal 1-click Exploit to Pwn Automotive Industry…