Tesla Wall Connector bootloader bypasses the firmware downgrade ratchet

Researchers have identified a method to bypass Tesla Wall Connector’s security ratchet, allowing firmware downgrades despite protections designed to prevent such actions.

The vulnerability stems from the bootloader’s reliance on the partition table to determine the active firmware slot, ignoring the ratchet stored in persistent memory. By manipulating the partition table through the existing update procedure, an attacker can set an older, signed firmware as active without triggering the ratchet check. The process involves writing to the partition layout without calling the routine that enforces the ratchet check, effectively allowing firmware downgrades. Experts confirmed that the bootloader does not verify the ratchet during the slot selection process, which is the core of this bypass. The exploit was demonstrated using a dump of the device’s flash memory obtained through prior rooting of a Tesla charger, revealing that the bootloader’s security model relies solely on signature validation and CRC checks, not on the ratchet mechanism during boot.

Why It Matters

This flaw undermines Tesla’s intended security model, which aims to prevent firmware downgrades that could reintroduce vulnerabilities or compromise device integrity. It exposes a potential attack vector for malicious actors to install older, potentially insecure firmware versions, raising concerns about the security and update process of Tesla Wall Connectors. The discovery also highlights the limitations of relying solely on cryptographic signatures without integrating ratchet-based protections at the bootloader level.

Background

Tesla’s Wall Connector firmware updates use a slot-based system with a ratchet mechanism stored in persistent memory to prevent downgrades. The update process involves writing new firmware to a passive slot and then switching slots via a routine that checks the ratchet before activating the new firmware. However, the bootloader, which loads the firmware at startup, only verifies signatures and CRCs, not the ratchet. Researchers previously analyzed the flash memory and identified that the slot switching process depends on partition table manipulation, which can be exploited. The recent discovery builds on this by showing that the ratchet check is bypassable during the slot activation phase, enabling the installation of older firmware versions without triggering security protections.

“The bootloader trusts the partition table for slot activation, ignoring the ratchet in persistent storage, which allows us to revert to older firmware versions.”

— Security researcher

“Our security protocols are designed to ensure device integrity, and we are investigating this report.”

— Tesla spokesperson

What Remains Unclear

It remains unclear whether Tesla will implement a firmware or bootloader update to fix this vulnerability, or if other security layers could prevent exploitation. The full scope of affected devices and potential for remote attack remains to be confirmed.

What’s Next

Tesla is likely to release a firmware update or bootloader patch to address this vulnerability. Researchers and security experts will monitor for official responses and any updates that reinforce device security. Further analysis may reveal whether the flaw can be exploited remotely or requires physical access.

Key Questions

Can this exploit be used remotely?

Currently, it appears that physical access to the device’s flash memory or a compromised update process is necessary, but further investigation is needed to determine if remote exploitation is possible.

Will Tesla fix this vulnerability?

Tesla has acknowledged the report and is expected to develop a firmware or bootloader update to close the security gap.

Does this affect all Tesla Wall Connectors?

The vulnerability is believed to affect devices running firmware versions that rely on the current partition and bootloader configuration, but the full scope is still being assessed.

What are the risks of this exploit?

Potential risks include installing older firmware with known vulnerabilities, compromising device security, or enabling unauthorized access or control.