Unpatchable AMD Chip Flaw Unlocks Paid Tesla Feature Upgrades

ijeff@lemdro.id to Technology@lemmy.world – 1327 points –
Unpatchable AMD Chip Flaw Unlocks Paid Tesla Feature Upgrades
tomshardware.com
160

For example, 2021 Model 3 SR+ vehicles can enable the Cold Weather Feature (heated steering wheel, heated rear seats) for an extra $300. This feature unlock is confirmed to work with the exploit.

So like cucks people were paying for something that their car already had offline, both hardware- and software-wise.

No kink shaking please. They like to watch when daddy X smashes their bank accounts, there's nothing wrong with that.

There is a kink where guys get off on sending women money, often without having any contact with her. It's called FinDom.

I'm open to becoming a FinDom daddy. Send me your money cucks!

Pretty sure you would be a fin sub in that case

Can I cuss them if they send too little? Does that turn them on? I guess I could finally get into sex work.

Which should be illegal. I get not adding a feature, but software unlocks or subscriptions to hardware you paid for is absurd. Also see Tesla batteries.

You didn't pay for it.

Tesla includes it at loss because it's cheaper than making you a special version without it, and it opens up new sales by reducing the price (e.g the originally locked batteries let them sell a substantially cheaper car than they could have otherwise)

Subscriptions for that should be banned, but including heated seats and making you pay once to access them is fair game.

Manufacturers dont owe you anything for free.

Edit: also, short of something like FSD which depends on future work from Tesla, I don't think they have a right to prevent you from bypassing a lock and accessing those heated seats if you can

If you pay to add a feature to a product that was previously not available, sure, that makes sense. But in this case, at the point of the transaction, and they hand over the keys, the ownership of the product is now 100% transferred to the customer. They should and can do whatever they want with their property. A manufacturer equipping a feature because it's cheaper is frankly not the customer's problem.

Imagine buying a house but you only get access to certain rooms. They set the price, the customer just pays for it. If they want to cover the cost of adding the heated seats feature, then add it to the starting price.

Imagine buying a house but you have not get access to certain rooms.

A bit off topic but thatā€™s kind of how condos work btw. You donā€™t actually own the apartment or townhouse, you just own shares in a corporation that gives you the right to live in that space, with some severe restrictions.

Often you donā€™t have the right to mow your own lawn, you canā€™t keep certain things on your balcony, you canā€™t have a dog over a certain size, etc. Itā€™s kind of nuts tbh. They give you the illusion of owning the space, but itā€™s a very restrictive form of ownership.

The automotive equivalent of that would be a lease rather than a purchase though, as I see it.

Well no, a lease is literally a lease. People do lease houses too you know. When people ā€œbuyā€ a condo, thatā€™s not a lease.

The point Iā€™m making here is that the housing analogy doesnā€™t work (ā€œImagine buying a house and not being allowed to Xā€) because people literally ā€œbuyā€ houses and are not allowed to do basic things that youā€™d assume come with house ownership.

Iā€™m not defending that this is ok. For me buying a condo would be as ridiculous as buying a DRMed Tesla.

See my original edit which was before this reply, and my follow up to another person on the same post replying like you.

I'm not objecting to unlocking heated seats. I do object and consider something like FSD entirely different though.

Your original reply stated that "including heated seats and making you pay once to access it is fair game" is what prompted my reply. Users shouldn't be paying for it if it comes with the product, disabled or not.

I have no qualms about subscriptions for FSD due to continuing developments and improvements, and the fact that it requires a service running AI/ML models to operate. However the drastic subscription cost changes over 3 years raises an eyebrow. From $5000 in 2019 to $15000 in 2022 is quite a drastic change. They certainly have the right to price how they want, but definitely an insane pricing model.

Especially when FSD is still garbage. Seems to me like they just wanted to trigger FOMO.

If your problem with my statement is that Tesla shouldn't even be allowed to charge them for it in the first place then we'll have to disagree. They can sell whatever product they want with features locked away. If people don't want to buy a SR because it doesn't have heated seats without a fee then don't buy it.

Trying to make heated seats a subscription is where I'd draw the line and say regulators should step in.

And again, no qualms with people jailbreaking heated seats

I see where you're coming from. And I also agree with the subscription heated seats.

I think we might actually be advocating for the same thing lol. I was making the argument that manufacturers should have a one-time price for things that are packaged along with the product (with the exception of features like FSD that requires a continuing service to operate and evolve), but jailbreaking static features like heated seats is fair game.

However, your post got me thinking... If it is reasonable for FSD to be a subscription model, how are FSD updates different than, let's say, your phone having updates and security patches? We don't currently pay for new versions of iOS or Android. Granted the complexity and stake of FSD is greater than a phone, it is similar fundamentally

We don't pay for phone updates, but there is software out there that's a buy a version and get all updates to that version, but not a new version.

E.g buy 5.0, get 5.1, 5.2, 5.2.1, 5.3 etc but not 6.0

Usually that kinda software stays on a version for years.

My Jetbrains IDE is a subscription fee like that. Yearly fee gets you all major version updates, but you keep it as is if you stop paying.

Phone updates don't come for the life of the car phone either.

Would you pay a yearly fee to continue getting updates for your now no longer being updated but perfectly fine otherwise phone? I would.

Would you pay a yearly fee to continue getting updates for your now no longer being updated but perfectly fine otherwise phone? I would.

Good question. At that point I'd explore replacing the OS altogether with GapheneOS or LineageOS.

When it comes to cars though, I don't find FSD an appealing enough value to continue paying (or even begin to pay in the first place). But to your point, that doesn't mean Tesla shouldn't price it how they want and people to buy it if they wish.

1 more...
1 more...

Actually, yes.....when you leave a lot with what you bought, you did, indeed, pay for it.

Their shitty business practices to exploit consumers are designed to favor their decisions as a net gain. And usually, it is a safe bet. An easy win. Hell, even in this case it still will be. Last I checked, they were turning a profit.

When the consumer finds a win, it's not "getting something for free.". It's a small victory for the consumer on a bad business decision by the company. The companies sure use a lot more loopholes than the consumer to squeeze a buck out of everyone. They assumed they would make money giving things away as a deceptive practice. Most times they win. This time, it didn't work out for them. Oh well. Free market and all. I'll not be losing any sleep over it tonight.

You left with the hardware, and accepted that it was locked. You didn't pay for access to it.

In my edit which was well before your reply, I explicitly stated I'm okay with you bypassing a lock like that to gain access to heated seats. You have a right to modify your car and tough luck if tesla didn't protect it well enough. That's not your problem, that's theirs.

FSD is another matter though. It's actively developed software that's pushed to the car if you paid for it. Software that will in the future push liability onto Tesla if they are successful. Tesla doesn't have any obligation to provide that software, updates, or access to it regardless of any hack that's done, and I imagine the NHSTA would even require them to devise a way to prevent access due to liability issues that might arise.

Edit: one is accessing something you own but don't have access to through a hole they left open. The other is piracy/theft

The unjust power companies have over their users through their proprietary software is far more worrying for us as a society than some users having unauthorized access to software on a product they own (not "piracy", that's a propaganda term from the film industry).

4 more...
4 more...

Tesla actually market it as a positive.

Car manufacturers have to setup different manufacturing lines to provide different feature levels. Tesla argue this makes them more expensive. Tesla cars have all features installed, just disabled and the optional extra packages are cheaper compared to their rivals as a result.

To be honest there is a certain logic, if you've ever been in a Ford Focus LX (bottom range) its pretty clear they had to spend quite a bit of money on more basic systems. I honestly thought each LX was sold at a loss

Then make heated seats part of the base model. In the 1950s a heater was an optional accessory, but became standard sometime in the 1960s. (I don't know exact years, if someone fact checks me I'm probably wrong, but close enough for discussion) radio went from not an option to am was an option, to FM mono, FM stereo, cassettes, CD, mp3. At one point you could get a record player as well (I think only about 200 were sold in total). AC used to be an option, became standard in the 1990s.

We will keep running this game as manufactures decide to make more and more things standard to make assembly easier.

You can get any color you want as long as itā€™s black.

But also fuck Tesla if I own the computer and the seats so I can do whatever I want with them

While I'm not a fan of many of these things, it locked behind a one time fee is better than these subscription models many are coming out with.

I hate that you are right. How did we manage to fuck up heated seats. Itā€™s literally just supposed to keep our asses warm. This ainā€™t some complex software intensive thing like navigation

Pay 19.95 per month for your brakes to work!

For no extra charge, you get standard braking ability.

For emergency braking, you can either pay $19.95/month OR $49.99 per occurrence!

That's just paying a little more for your car when you buy it, not as a dlc.

Unless you couldn't afford the fancy features and later could, or move somewhere colder from somewhere warm, but all the pieces are already there and built.

Itā€™s quite uncommon to have line splits for specific features. The only thing in a Tesla that might require a split is dual vs single motor. Heated seats would just be a station skip, where the worker or robot ignores cars without the feature. (Source: I used to write assembly line control software for this exact sort of thing)

It doesnā€™t save Tesla any money, except in marshaling. If they build a mix of lots of options then they have to track them all. With their simplified option list, cars are more interchangeable.

It also makes upselling possible, even after delivery, which is 98% of why they do it.

Itā€™s a very old practice. IBM mainframes back in the 1970s/80s would come in various configurations. ā€˜Upgradingā€™ the machine to the improved performance spec was achieved by cutting an internal wire

Well, for what itā€™s worth, I donā€™t think the base cars pay for heated seats. It was more of an early Model 3 thing. I could go into the economics of why, but I doubt that would be a productive conversation

I've thought for a while that Tesla relies a lot on people who a) have money to throw at a car that's too expensive, b) have money to throw at features that should be free, and c) do a and b because they think Tesla and Musk are cool.

Not defending this practise but this is nothing new and has been happening for decades on other cars. Itā€™s typically cheaper to manufacture everything on mass, including the higher features, and just not wire it up in lower end cars. Very common for things like heated car seats, I remember one of my old Mitsubishi had everything in the seat but just didnā€™t have the heated seat control button and fuse.

Locked by software is a whole new level though.

but that wouldnt stop you from buying the switch and putting it in your own. and mitsubishi wasnt removing your service apointments or cancling your subscriptions when you complained.... or modified your car... and i will bet you could order the parts missing direct from mitz as well as having them install them or...gasp a third party garage.

Constant drm checks are what's different. I in the old days, the company cannot track you as efficiently as today, so you have more freedom to modify you car. Today there is a somewhat live update of what you are doing with your car, and the company has the power and means to punish you accordingly.

Itā€™s probably cheaper to build cars that way than to have dozens of different configurations. The small loss they take on the hardware by giving away the hardware but locking it is offset by the increased production efficiency.

Nah, they only need to split production lines when things are radically different. Excluding parts is usually easy, because the production line simply doesnā€™t install the missing part. The car still moves through the same line at the same rate regardless, so it saves them parts to not install.

The real reason they include them is so they can have their salespeople upsell you at the store. You werenā€™t originally planning on getting heated seats, but itā€™s only a few hundred more to do it and youā€™re already applying for the loan. A few hundred wonā€™t make a huge difference. Also, we have this other feature thatā€™s also only a few hundred more, and this other feature, andā€¦ Before you know it, theyā€™ve upsold you into paying $5k more than you intended, simply by activating things that the car already had installed.

This has apparently being a thing for a long while. I read that in the past some models of BMW came with heated seats but the switch (and maybe a relay I'm guessing) why for unless the premium was paid. It was an early diy upgrade

cucks

We donā€™t use that word here.

4 more...

If all electric cars are just going to be subscription bullshit, I'm sorry, I won't be driving electric.

Even ICE manufacturers have been including hardware that software disabled for a while

I got an OBDeleven for my 2015 GTI so I could unlock stuff and customize. Enabled rolling down the windows with the key fob, being able to display the engine oil temp in the dash and also setting the accelerator pedal curve to linear.

What I didn't even know that was stuff you could even do

The accelerator curve is really cool. A lot of modern cars just have a sensor that detects your pedal position and a simple algorithm decides how much power to translate that into. It's like adjusting the mouse speed on a computer. Feels like you're driving a different car.

Having said that, the default curve is often the best curve. They put a lot more effort into getting it right than you would.

Almost every car company does something similar and has as long as they've had on board computers.

VW/Audi/Porche are all the same company and generally share the same electronics. A lot of gauges and features are considered "premium" so they just disable them for VW branded vehicles. There's also regional feature lockouts; IIRC North American VW's can't have their fog-lights and headlights on at the same time but you can enable it through VAGCOM.

1 more...
1 more...

Subscribe to enable your BMW seat heater! They definitely require periodic software updates and is absolutely NOT a blatant money grab

Audi had been doing this for years and they even disable stuff if you sell your car to another private person. One of my friends bought a used Audi and everything was disabled so he installed a cracked version of the infotainment software and now the only thing that doesn't work is the fingerprint unlock.

A fingerprint unlock on a car? I've never heard of that, is it to unlock the doors?

Probably used for user profiles for the seats and stuff and Aircon. Mercedes does it too

Don't know: there is a fingerprint reader on the handle of the car but it doesn't work

There are some manufacturers that do not do this garbage, or at least not often. I've heard good things about Hyundai specifically.

For now they have customer goodwill to win back after nearly a decade of building cars that practically fell apart in a year or 2 in the late 00s and early 10s.

They'll catch up to the others in anti-consumer practices soon, but for now they're a good choice if you don't particularly care for performance or ride quality.

Tesla got rid of the heater subscription bullshit in 2021. Now, the only thing locked behind a paywall is internet related stuff (sentry over mobile, streaming media access, etc.), the performance boost, and FSD.

But if the car is completely capable of habe that performance, why should people pay for it.

Oh I'm just correcting the article. Facts are better than fiction for conversations about reality.

1 more...

It wonā€™t just be electric cars, itā€™ll be all new model cars from manufacturing companies. At least until ICE is phased out.

More like, until the Chinese weasel their way into the US market with cheaper-than-used cars to undercut the legacy auto makers. 10 years or so, it'll happen. And the big 3 will be begging for bailouts again. That is unless they smarten up and remember what made Ford what it is today.

remember what made Ford what it is today.

American can-do spirit, worker's rights, and throbbing fuckloads of antisemitism.

I don't see that happening. The US puts large tariffs on imported cars to stifle competition. That's why if you look at Japanese cars in Japan or German cars in Germany they're often much cheaper and more powerful than their American counterparts.

German cars in Germany

German cars in Europe also seems to last pretty decently where as American-made German cars apparently keep falling apart after 5 years lol

They're already doing that in some parts of the world. Then when they get sizeable market share, they emulated what the previous car makers do. It's just not an improvement. It's more of the same, only the manufacturer is different.

You know what Ford stands for, don't ya? It stands for 'Fix it again, Tony' hehehe.

Yeah. GM's subscription nonsense is for their ice cars too. BMW's aborted seat heater thing was too.

This is why I keep an oldish diesel car with no extra electronic features in my garage. No weird features, and can still run even without a battery.

Although, I think the reason I kept the car is because of my paranoia of an EMP event frying electronics.

Yeah that's true. I wonder if the market for older cars has been going up yet.

Have you seen the automotive industry as of late? This isn't a EV issue nor is it really new. We've had things like OnStar for years and the entire industry has started to chase the gaming industry's microtransaction BS for a while now.

https://www.theverge.com/2022/7/12/23204950/bmw-subscriptions-microtransactions-heated-seats-feature

https://www.thedrive.com/news/43329/toyota-made-its-key-fob-remote-start-into-a-subscription-service

The future looks like a potential live service hell scape for the auto industry EV or otherwise.

Everything is being ruined. It feels like hyperbole but I'm not sure it is.

Yes, I know it's industry wide. What I'm saying is that with EV being the future of cars I don't want them all to be subscription based.

I have a Rivian and it works great with no subscription. The only thing you can add via Sub is a hotspot, which seems reasonable to me.

I'm okay with being charged a monthly subscription for something that has an ongoing cost, like mobile data. So long as I can still hotspot my phone and access 'premium connectivity' features over wifi, that is.

Yeah about those 'premium connectivity features'... one of them is warning you that the road you're about to drive on has a traffic jam. And no, you can't have it use your phone's internet connection and you also can't do CarPlay or Android Auto.

For me real time traffic isn't a premium feature or an ad on. It's table stakes. And it should be free. Worse, not having it already almost makes your car hard to sell secondhand. Imagine what it'll be like several years ago when people start selling Rivians?

I agree, I do think they should allow both aa/cp, and wifi while driving so you can tether to your phones wifi. I'm not as doom about secondhand sales as you seem to be though.

It's not just the mobile data that's spendy, it's the API calls to the vendor(s) they're getting that data from.

Android Auto/Car Play would be nice, but having used both, the native Tesla nav is better.

At some point, there will be practically nothing else to drive...

All the more reason to support public transportation.

The average lemming:

  • concerned about online privacy
  • strongly against digital surveillance
  • rides exclusively public transit where there is surveillance everywhere

There are fundamental differences between physical and digital surveillance, namely when you are in a public space there is no expectation of privacy because there are other people there looking at you. When there are other people there that can actually see you, a camera also watching doesn't make much of a difference.

it does

people usually doesn't remember you unless you do some weird shit but once recorded, it will stay for the rest of eternity

If you're talking about standard security cameras usually the footage will get completely overwritten after afeew days unless there was an incident to prompt review of the footage-- and even then it usually gets deleted at some point. Its not like with social media data gathering where they're collecting all that information in order to build a personal profile of everyone-- security cameras just exist to review incidents that happen in the public realm and there's no real incentive for a public transit agency to track every single person that appears on their cameras.

There's cameras everywhere watching the road too if you really care that much and you better believe your car model and license plate is a much more reliable form of identifying information than a blurry face on a bus security camera.

There is surveillance everywhere outside, even having your own car doesnā€™t protect you from having your privacy encroached. Thatā€™s why I never go outside.

By 'surveillance,' do you mean a bus security camera to make sure no one is stabbing the driver? Because I'm pretty sure most of us don't have much of a problem with that. It's comprehensive government surveillance that is the problem.

Unfortunately, "camera to make sure no one stabs the driver" is the exact tool used by "comprehensive government surveillance". It's something we're forced to accept.

I would like evidence that security cameras on buses are used by the government for comprehensive surveillance. I don't even know how they would accomplish such a thing with a stationary camera in a bus.

I hope you don't go outside at all, with that mentality.

When does "you should minimize your physical footprint so that you are harder to profile by bad people" suddenly become "just stay inside at all times and never go out"?

Even with digital privacy, nothing is 100% effective.

When you decided to make an ignorant comment about public transportation.

Obviously nothing is 100%. That's a given and doesn't need to be said.

Sure there will, always. Fix it yourself jalopies aren't going away. Get yourself a cheap-o used junker and mod it to be electric, if you can't or won't use ICE. DIY isn't just 3d printers and FOSS. Or get a bicycle and mod it into an e-bike.

All these upgrades are one time payments for an upgrade, much like sales point dealer add-ons for conventional cars. However recently they did allow you to buy a monthly subscription to FSD. But the option to buy it outright was always there, and still remains.

2 more...

Cool! Now work on exploits for those paywalled features of BMW cars and Ford cars.

If you pay for something it's yours by right. You should be able to use the entire thing, because you physically have it now.

Good. There should be no such thing as unserviced features that are physically present in a product and locked out against its owner. Not in cars or anything.

Why not?

Because it's abusive and blatant rent seeking.

Look, if there's an actual service feature that continually costs money to provide (eg.: a cell connection for distant remote start, GPS nav map updates, etc), charging a reasonable subscription fee for that is totally acceptable. But charging ongoing fees for fixed features like heated seats is 100% bullshit unless you're going to include some sort of service benefits like free repairs (which I doubt they're doing).

1 more...

Good. Fuck Elon.

No, don't! He has enough kids.

Next we will see tesla bricking cars were users have done this

More E-waste!

Unlikely, but expect to see more language in sales contracts that "if absolutely any of the software is fucked with in absolutely any way that wasnt done by us the vehicles warranty is absolutely null and void. We also reserve the right to refuse to provide any and all parts and services to any vehicle found to have had its software modified outside of factory parameters." And you best believe they will keep a list of vins and wont care if it was the previous owner.

Even if it is in the contract, it's not enforceable (depending on country). In a fair few, the manufacturer has to prove that the modifications caused the defect to invalidate the warranty.

It's unclear what would happen if they simply refused to service the car, or bricked it instead.

Bricking it would be a legal minefield for them, they wouldnt dare. But making literally anything to do with servicing, updates and repairs such a colossal ball ache that its easier and cheaper to just pay for the heated seats...

I did speak a little broadly, they couldnt deny you the warranty on the wheel bearings or purely mechanical parts but they dont need to prove that the jailbreaking is the cause of literally anything electrical going to shit, they just need to say "That item is controlled by software that has been modified outside of manufacturers specifications, we are refusing to honor the warranty on this item"

Same with servicing "As this vehicle has been modified outside of our recommended parameters we cannot guarantee our repairs and as such we recommend the customer seek an alternative mechanical workshop for servicing and repairs"

Oh sure, you could fight it and win, you might join a class action and get $8 in 3 years time. Or... just dont jailbreak their product and make your life hell. I absolutely disagree with this subscription and paywall bullshit, but I do not underestimate the tomfuckery that big companies will pull to fuck customers.

A subscription for hardware is such bullshit, I hope this trend dies.

We can all do our part by not buying anything from those who do this.

This is the best summary I could come up with:


Utilizing multiple connections to the power supply, BIOS SPI chip, and SVI2 bus, the researchers performed a voltage fault injection attack on the MCU-Z's Platform Security Processor.

"They allow an attacker to decrypt the encrypted NVMe storage and access private user data such as the phonebook, calendar entries, etc."

"Hacking the embedded car computer could allow users to unlock these features without paying," the TU Berlin researchers add.

In an email to Tom's Hardware, one of the researchers clarified that not all Tesla software upgrades are accessible, so it remains to be seen if those premium options will also be ripe for picking.

Another consequence is that the exploit can "extract an otherwise vehicle-unique hardware-bound RSA key used to authenticate and authorize a car in Tesla's internal service network."

The TU Berlin team (consisting of PhD students Christian Werling, Niclas KĆ¼hnapfel, and Hans Niklas Jacob, along with security researcher Oleg Drokin) willĀ present their findings next weekĀ (August 9) at the Blackhat conference in Las Vegas, where we hope to hear more about all the feature upgrades that are accessible.


I'm a bot and I'm open source!

Nice anti-AMD framing so shortly after that latest Zen2 vulnerability.

Right? Probably for attention grabbing, cause they do say the same flaw exists in zen2 and zen3, and the article is by no means slamming AMD for it. But the title does come off that way

It's probably because there are both Intel and amd Tesla cars. Newer models use AMD

Idk unpatcheable vulnerability for the core component of the system seems pretty negligent but what do I know

Not like they make boat loads of profit and are definitely just cutting corners on aspects of staffing to save extra money up for when the planet inevitably burns down (due to the very same people)

The vulnerability is much more of an issue for Tesla('s profits) than the owners. It's not a simple exploit and not the worst concern for average users of those chips. You have to have physical access to it in order to exploit it, as well as a system worth hacking (think, national security trying to prevent compromised personnel from physically using the exploit on their systems). I'm not worried about someone breaking into my house to physically hack my computer, just to find some memes and bullshit

It still has to be addressed by both Intel and AMD, because that's their whole industry. But recalls and such aren't needed, because bugs can be exploited all over the place and this one isn't a high level risk for the average end-user. It's more of a concern for Intel/AMD reputation and the large industry users of their chips

Literally stealing the food from the plates of those hard-working millionaires/billionaires (if you ask them). How will they ever continue to float to the top of the net worth leaderboard now?

The title seems much more interesting than it is. I doubt most people have the ability to perform this type of exploit. It would be more interesting if a group would charge X to unlock it for you.

I hope that becomes more common as these types of features become more prevalent across multiple OEMs. I'd pay a tech-savvy mechanic or a car-savvy hacker quite a bit for features that are already installed but locked behind some arbitrary paywall.

I also just hope regulators put a stop to such behavior first, but I kind of doubt that will happen.

I see MusX stopping people's car in the middle of the highway when they found out.