Security researchers found administrator credentials for an unnamed carmaker's connected vehicle platform exposed in a vendor file bundled with its smartphone app, allowing them to remotely unlock cars, start and stop engines, reset passwords and bypass multi-factor authentication. The automaker has since fixed the flaw, but it never named itself publicly.
How the credentials leaked
Shubham Shah and Sam Curry discovered that the car company had exposed administrator credentials for the identity management system behind its connected vehicle app, according to iTnews. The credentials belonged to the ForgeRock OpenIDM system, which manages every account on the undisclosed company's connected vehicle platform, and were embedded in a vendor JavaScript file that the app uses to carry out tasks and talk to online systems.
Because that file shipped with the Android app, everyone who downloaded it received the administrator credentials along with it. Shah is co-founder of the Australian security firm Assetnote.
The researchers started from a single number plate and worked their way into the affected automaker's connected vehicle systems from there. Connected cars, meaning vehicles linked to the internet, now take in most new models on sale, and brands offering connected vehicle apps in Australia include Toyota, Ford, Hyundai, GWM, BMW and Tesla.
What the researchers could do
Once inside, the pair could remotely unlock vehicles and start and stop their engines wherever those functions were enabled. They could also reset user passwords and get around multi-factor authentication for the app.
The access reached personal details including phone numbers and full names, plus further data such as the vehicle identification number. Shah told iTnews that other methods of unlocking these cars surely exist, but the route the researchers used was fully remote and would affect any customer who had the relevant functionality switched on.
The carmaker's Australian systems proved easier to get into than its North American ones, with the local web application firewall offering weaker protection. The report described the manufacturer as one that sells two brands in Australia, a detail that narrows the field without settling it.
The obvious question, which carmaker was it, has no public answer: the company was not named in the report. That matters because owners of any connected car have no easy way of knowing whether this particular flaw touched their vehicle, only that it has been closed.
Why connected car security is under scrutiny
The disclosure lands amid wider calls for more transparency over how owner data is used, stored and managed. In-car system vulnerabilities drew attention earlier this year on the ABC current affairs program Four Corners, when cybersecurity professionals got into a BYD Shark 6 ute and recorded phone calls made through the vehicle, among other things.
For buyers, the practical lesson is that a connected car's security is only as good as the app and the identity systems behind it, and those sit with the manufacturer rather than the driver. The fix here came after the credentials had already been sitting in every downloaded Android app, which suggests the exposure lasted until the researchers raised it.
