Researchers Shubham Shah and Sam Curry remotely unlocked and tracked cars from two unnamed automakers whose login servers used the default password admin.
The access matched an owner’s app, exposing door controls, engine start and stop, and real-time location and telemetry.
Two security researchers gained remote control of internet-connected cars from two major automakers earlier this year after finding that the companies’ customer login servers still used the factory default password admin, according to a technical write-up the pair published November 7.
Shah and Curry bypassed the firewall by disguising requests to the admin paths as ordinary static files, then logged in with the documented default of admin for both the username and password.
They changed a test account’s email and password without ending the real owner’s app session, then issued remote commands over the same routes the official app uses.