All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine — now-patched hard-coded credentials and bypassed MFA security showcase a lack of 101-level best practices

The vulnerabilities were quickly fixed, and they pertained to a handful of belief-begging security issues with multiple server APIs that their respective mobile applications use.

This alone was enough to grant Shah the ability to pull up customer information with API keys that were hard-coded into said JavaScript.

From thereon, they found "getUser", and correctly guessed that they could retrieve users' information with their email, phone, and ID.

As it turns out, even that too was misconfigured, as the Australian environment would let users skip MFA entirely.

Then, it was as simple as sending out an API request for the "door-unlock" command, and sure enough, the test car promptly opened.