Researchers say they found a way to tap into Tesla's most advanced features — without paying for them

• Tesla uses in-car purchases to unlock all sorts of improved features and upgrades.
• Researchers in Berlin say they found a way to circumvent that, and get new features for free.

Tesla owners use in-car purchases to unlock all sorts of vehicle features and upgrades. But what if they could do that without paying?

That's what researchers at Technical University Berlin sought to find. The doctoral students say they discovered a way to tap into all the improved functionalities and offerings that Tesla has as subscriptions, but for free, effectively hotwiring the cars.

Through Tesla software updates, the automaker allows its customers to snag new features like an "Acceleration Boost," a Premium Connectivity subscription, access to the Full Self-Driving package, and rear heated seats, all for a fee.

Having the ability to access these additions is a huge advantage for Tesla; even as its vehicles age physically, owners can pay to add to them over time to keep them up-to-date with the latest tech. However, the idea of vehicle subscriptions has also stirred debate, with people wondering if they should have to pay a monthly or annual charge for certain features that could come standard on some vehicles.

The researchers say they "attacked" Tesla's embedded car computer — known as "jailbreaking" — giving them the ability to run arbitrary software on the infotainment system, activate or disable features, and circumvent payment.

Tesla's security is supposed to be more advanced than that of other automakers (and cybersecurity is an increasing concern in the industry as more vehicles become more electronic) but this is not unlike how consumers "jailbroke" iPhones in the past.

Using a voltage-glitching vulnerability in the electronic control unit, the researchers bypassed Tesla's MCU-Z processor. That typically enables purchased features to go live on the vehicle from over-the-air. The nearly-irreversible hack gives control over the operating system and can't be reversed with rebooting or updating, only upgrades to the central processing unit.

"Currently, our attack can be applied by people with some electronic engineering background, a soldering iron, and the ability to purchase additional hardware for about $100," Christian Werling, TU Berlin researcher, told the website DarkReading.

The researchers said they were also able to break geolocation restrictions with their hack, which meant they could enable FSD Beta in places where it's not yet available.

At the same time, the hack meant they could migrate "a car's identity to another car computer without Tesla's help whatsoever," according to a briefing on the research, basically using the private key the Tesla owns for other purposes.