Security researchers Shubham Shah and Sam Curry discovered vulnerabilities in the connected vehicle systems of two major automakers. The flaws allowed unauthorized remote access to vehicle functions, including unlocking doors and starting engines.
The security gaps stemmed from poor implementation of authentication services provided by ForgeRock. Researchers identified hard-coded administrator credentials within JavaScript bundles and exposed server APIs that were accessible from the public internet.
Beyond vehicle control, the vulnerabilities exposed sensitive customer data, including email addresses, phone numbers, and vehicle location. In some instances, the researchers bypassed multi-factor authentication entirely to impersonate users.
The impacted vehicles were located in the United States, Canada, and Australia. While the names of the manufacturers were not disclosed, visual evidence suggests one of the affected models may be a Toyota RAV4 SUV.
The researchers successfully demonstrated the exploits by decompiling Android applications and chaining API requests. Both automakers have since implemented patches to address the identified security issues.
