It is tempting to say a safety layer in read-only memory cannot be hacked. It is also wrong, and we would rather say so ourselves.
What the researchers did
Doctoral students from TU Berlin, together with an independent researcher, presented an attack at Black Hat USA on the AMD Secure Processor inside a Tesla infotainment unit. That processor acts as the system's root of trust. Using voltage glitching, also called fault injection, they made it misbehave. The attacker needs physical access to the board, a soldering iron and about $100 of extra hardware. One researcher said the weakness cannot be fixed in software without upgrading the CPUs.
What a ROM does and does not do
Mask ROM guarantees the code is the code that was shipped, because it cannot be rewritten. It does not control what the chip does with that code if someone disturbs the power or the clock. A glitch can make a chip skip a check without changing a single stored bit.
What we design for
- Monitors on clock and voltage that trigger a stop when something looks wrong.
- Lockstep cores, so a skipped instruction in one core shows up as a mismatch.
- ECC memory and fault logic on every path.
- A physical key and tamper sensing for anything that changes limits.
We are grateful to the researchers who published this work. Honest failures of other people's designs are how everyone's designs get better.