Car app security flaw exposed admin credentials to researchers

Summarised from 2 outlets · Updated 12 Nov, 05:13 · Archive

Researchers discovered an unnamed automaker had exposed administrator credentials for its connected vehicle platform, allowing remote access to unlock and start vehicles.

Security researchers Shubham Shah and Sam Curry discovered a well-known automaker had mistakenly exposed administrator credentials for the identity management system behind its connected vehicle smartphone application. The credentials for the ForgeRock OpenIDM system were embedded in a vendor JavaScript file within the app. Everyone who downloaded the Android app received the file containing the administrator credentials.

Using access to these credentials, the researchers were able to remotely unlock vehicles and start and stop their engines where those functions were enabled. They could also reset user passwords and bypass multi-factor authentication for the app. The vulnerabilities granted access to personal user details such as phone numbers and full names, along with vehicle identification numbers.

The affected automaker, which was not named in the reports but sells two brands in Australia, has since fixed the issue. Researchers noted that the automaker's Australian systems were easier to access than its North American systems, with the local web application firewall providing less robust protection.

How it is being reported

• Car app security flaw let researchers remotely unlock and start vehiclesResearchers found an automaker had exposed credentials that could enable remote access to any of its vehicles with connected app functions enabled.Perth Now · 12 Nov, 04:41
• Car app security flaw let researchers remotely unlock and start vehiclesResearchers found an automaker had exposed credentials that could enable remote access to any of its vehicles with connected app functions enabled.The West Australian · 12 Nov, 04:41

In this story: Shubham Shah · Sam Curry · ForgeRock · Australia

This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem · Corrections log