Skip to content

Back to the catalog

i.blackhat.comtalk

Pedal to the Bare Metal (Black Hat USA 2026)

Black Hat USA 2026 slides from Tobias Scharnowski and Kristian Covic (fuzzware.io) walking through rehosting and fuzzing the bare-metal FreeRTOS firmware of the Tesla Universal Wall Connector (ARM Cortex-M4). They cover MMIO modeling (bitextract/constant models), scoping the fuzzer to the reachable UDS-over-CAN/ISOTP attack surface reachable from the charge-plug SWCAN line, seeding with a captured firmware-update UDS transaction (building on Synacktiv's Pwn2Own '25 charge-connector work), and triaging a FreeRTOS scheduler crash back to a signed integer/negative image-length bug in tesla_verify_sig causing an OOB stack write during firmware signature verification — enabling STM32 takeover, contactor/plug-release control, device bricking, and a path toward wormable, secure-boot-bypassing persistence.

TL;DR Black Hat 2026 talk on rehosting/fuzzing the Tesla Wall Connector's bare-metal firmware, finding a signature-verification integer bug that enables hardware takeover and worm potential.
Open original ↗

Organisations named here

  • Synacktiv
  • fuzzware.io
  • ISOTP
  • Kristian Covic
  • Pwn2Own Automotive
  • SWCAN
  • tesla_verify_sig
  • Tobias Scharnowski
  • UDS

Technologies named here

  • fuzzware.io rehosting/fuzzing framework
  • Tesla Universal Wall Connector
  • Ghidra
  • Synacktiv P2O exploit script
  • FreeRTOS

Techniques named here

  • Firmware rehosting for fuzzing
  • MMIO access modeling
  • Fuzzing scope reduction via task_launcher hooking
  • CAN/UDS/ISOTP protocol fuzzing
  • Timeout and response-queue patching
  • Input size limiting via exit conditions
  • Crash triage / root-cause analysis
  • Stack buffer overflow via signed integer underflow
  • Post-exploitation hardware takeover

Related in Hardware & RF