Tata Motors' connected car apps shipped hardcoded credentials, CERT-In warns
Hardcoded credentials and other issues in Tata Motors App
India's CERT-In rated four flaws in Tata Motors' iRA 2.0 and iRA.ev apps as high severity: service account credentials, API keys, and auth tokens baked into the app package, weak WebView URL validation, tokens written to debug logs, and broken SSL certificate pinning. Together they could let attackers impersonate users and reach vehicle data and remote commands. Researcher Pranav Rajendran reported the issues; fixes are in iRA 2.0 26.8.2 and iRA.ev 26.9.1.
An unauthenticated remote attacker could exploit this vulnerability by downloading application package and extracting embedded sensitive information.
- qtqtqt
Tata says the issue has been fixed and there were no leaks:
https://auto.timesofindia.com/news/cars/tata-motors-says-ira...
- tpowell
I feel like I just got a telegram... love the website.
- richbell
Par for the course.