Researchers Take Over Connected Cars in Australia and the US by Exploiting Weak Logins in Automaker Apps

Security researchers Shubham Shah of Assetnote and Sam Curry showed that flaws behind two automakers' Android apps could let an attacker remotely start engines, flash headlights and sound horns on connected cars. Both attack chains centred on weaknesses in the ForgeRock identity platform used by the two carmakers, whose names the researchers did not disclose. The work covered vehicles in Australia and the US.

In the Australian case, the researchers first found a vehicle identification number using public licence plate checkers. Querying internal systems with it returned personal details, including owner email addresses. They also found hardcoded admin credentials meant for a test environment that worked in the live one. After getting around the web application firewall (WAF) by exploiting path traversal flaws, they could take over accounts using only an email address and then send commands to vehicles through the app.

The US attack took more work, as Shah said that automaker had invested more effort in securing its systems. It also relied on bypassing WAF filtering, this time through path confusion to reach an admin console. Factory default credentials gave admin access and, ultimately, control of the identity servers. From there the researchers could view or change user account data, log in as car owners and issue the same commands.