Researchers examining vehicle security discovered an automaker had mistakenly exposed ‘admin’ credentials for its connected vehicle platform, potentially allowing unauthorised users to operate remote features on customers’ cars.
According to iTnews, security researchers Shubham Shah and Sam Curry found a well-known automaker (which was not named) had exposed administrator credentials for the identity management system behind its connected vehicle smartphone application.
A connected vehicle is one connected to the internet, which includes the majority of new vehicles on sale.
Brands with connected vehicle apps in Australia include Toyota, Ford, Hyundai, GWM, BMW and Tesla.
Starting with a vehicle’s number plate, the researchers were able to access the affected automaker’s connected vehicle systems, remotely unlocking vehicles and starting and stopping their engines where those functions were enabled.