Backend infrastructure failures included hardcoded, user-visible administrator credentials.
a]:text-inherit [&>a]:underline">
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works .
The vulnerabilities were quickly fixed, and they pertained to a handful of belief-begging security issues with multiple server APIs that their respective mobile applications use. Furthermore, although remotely opening the cars and starting them were the most concerning bits, the vulnerabilities also exposed the vehicles' location, mileage, fuel, range, door states, and the customers' personal information.
The white-hat hacking duo isn't disclosing the name of the impacted automakers, but they managed to get access to Automaker #1's U.S. vehicles, while vehicles from Automaker #2 were susceptible to unplanned lock disengagement in Australia, the U.S., and Canada. As far as we can tell by visual inspection alone, the second firm may be Toyota, as the hack demonstration video appears to depict a RAV4 SUV.
Both affected automakers use ForgeRock's authentication and authorization services, though with the one small exception, the vulnerabilities found by Shubham Shah and Sam Curry pertained to poor implementations and security practices. One of their writeups goes over the ForgeRock-related affairs in detail for both companies, while Shah's article discusses the specifics on automaker #2 and their Australian connected-car infrastructure.
Shah first decompiled the company's Android application and found network calls to a telematics subdomain, quickly finding an "admintool" location containing a "TEST HARNESS" page with a login prompt. If you haven't been keeping track by now, the first problem is that this endpoint is reachable from the internet at large. But what really piqued Shah's interest was problem #2: a bundle of JavaScript code that should have been stripped of any unnecessary cruft actually contained the code for the backend's entire functionality, providing a map for further shenanigans.
Security researcher had to jailbreak their car just to update the clock
Key considerations
- Investor positioning can change fast
- Volatility remains possible near catalysts
- Macro rates and liquidity can dominate flows
Reference reading
- https://www.tomshardware.com/tech-industry/cyber-security/SPONSORED_LINK_URL
- https://www.tomshardware.com/tech-industry/cyber-security/all-net-connected-vehicles-from-two-major-automakers-allowed-hackers-to-remotely-unlock-doors-and-start-the-engine-now-patched-hard-coded-credentials-and-bypassed-mfa-security-showcase-a-lack-of-101-level-best-practices#main
- https://futureplc.com/privacy-policy/
- Grab this GameSir Super Nova wireless controller at a record-low Amazon price, now under $40
- Nintendo unleashes DMCA takedown wave against open-source Switch modchip firmware, 144 tools disabled
- Ukrainian drone operations squeezed by fiber optic cable shortage triggered by AI data center buildouts
- NVIDIA Announces New Planned Investments in Korean Startups at the MSIT-NVIDIA AI Startup Partnership Forum
- Nvidia CEO Jensen Huang summoned to Congress over affair with alleged Chinese spy
Informational only. No financial advice. Do your own research.