Car app security flaw let researchers remotely unlock and start vehicles

Researchers examining vehicle security discovered an automaker had mistakenly exposed ‘admin’ credentials for its connected vehicle platform, potentially allowing unauthorised users to operate remote features on customers’ cars.

According to iTnews, security researchers Shubham Shah and Sam Curry found a well-known automaker (which was not named) had exposed administrator credentials for the identity management system behind its connected vehicle smartphone application.

A connected vehicle is one connected to the internet, which includes the majority of new vehicles on sale. Brands with connected vehicle apps in Australia include Toyota, Ford, Hyundai, GWM, BMW and Tesla.

The reported security flaw saw credentials for the ForgeRock OpenIDM system, which manages every account on the undisclosed car company’s connected vehicle platform, embedded in a vendor JavaScript file which contains code used by the app to perform tasks and communicate with online systems.

Starting with a vehicle’s number plate, the researchers were able to access the affected automaker’s connected vehicle systems, remotely unlocking vehicles and starting and stopping their engines where those functions were enabled.

They were also able to reset user passwords and bypass multi-factor authentication for the app. The vulnerabilities granted access to personal user details, such as phone numbers and full names.

Further details were also accessible, including the vehicle identification number (VIN).

According to iTnews, everyone who downloaded the Android app received the file containing the administrator credentials.

The undisclosed vehicle manufacturer, which the report stated sells two brands in Australia, has since fixed the issue.

The researchers also found the automaker’s Australian systems were easier to access than its North American systems, with the local web application firewall providing less robust protection.

“I'm sure there are other methods to unlock these cars, but the vector we had was fully remote and would affect any customer with the functionality enabled,” Mr Shah, co-founder of Australian security firm Assetnote, told iTnews.

The news comes after calls for more transparency on how owner data is used, stored and managed.

Vulnerabilities in in-car systems were highlighted in a report on ABC current affairs program Four Corners earlier this year, when cybersecurity professionals accessed a BYD Shark 6 ute.

This included recording phone calls made through the vehicle’s in-car phone system, as well as operating functions such as the headlights and windscreen wipers remotely.

This prompted BYD Australia to launch its own investigation. It said initial physical access to the vehicle was required to achieve the level of access shown on Four Corners and announced a software update to strengthen security.

MORE: Polestar takes "full responsibility" for data security in its cars, will track AI energy usage