Hackers Could Unlock Any Car From a Major Automaker Using Credentials Hidden in a JavaScript Bundle
Unlocking any car from X brand in most of the world
Security researchers Sam Curry and Shubs chained together exposed admin tools, hardcoded OpenIDM credentials buried in a vendor JavaScript bundle, and a WAF bypass via path traversal to take over customer accounts on a major automaker's connected car platform. Starting from a license plate, they could resolve a VIN, pull account PII, reset any user's password, skip MFA, and mint app tokens capable of remotely unlocking, locking, and starting vehicles.
I'm not sure a WAF rule has ever stopped us when we're motivated enough, so we invested days into finding a way out of these protections, using our trusty path traversal tricks.
- ryukoposting
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
- everdrive
It seems ridiculous that there would be consumer demand to unlock a car from a phone in the first place. The tech crowd will just complain that it should be easier to do a better job securing web services. But what is the point of all this infrastructure and complexity? So you can be just a little bit more lazy. This sort of tech is both a vulnerability and a waste of human resources and ingenuity.
- avodonosov
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
- devy
The vulnerability is with traditional automakers.
Most of the newer EV brands (at least in North America, e.g. Tesla, Rivian, Lucid) are very sensitive to automotive telemetry security. AFAIK, they are built by software engineers in house and operating like a software company than a traditional automaker whose software are NOT made by themselves but by 3rd party OEM auto suppliers who may or may not have the security mind when they release their product. In general automotive industry did not have the foresight in security engineering and neither did they do that when it was heavily mechanical and local systems instead of IoTs and electronics when they started.
So the author exaggerates their claim of their work can affect any car in United States.
Every telsa API calls are using the latest TLS 1.3 with X.509 for key card access. Their software updates VERY FREQUENTLY. And they don't use the *-telemetry.com domain that was demonstrated in their hack.
- maistho
I'm always confounded by how bad most car security seems to be. I've given this about 5 seconds of thinking, and wouldn't it be pretty simple to do a local app-car setup step that generated a private key stored in the app and stored the public key in the car, requiring all commands to be signed with the private key in order to be accepted? There's no reason why the car manufacturers server should even be allowed to send commands to the car just based on a user account anyway.
- winny314
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
- intuitionist
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
- memoriesofsmell
The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs
- NooneAtAll5
I think automaker failed security the moment its cars connected to the internet
- moktonar
The fact that cars can be controlled over the net at all is itself absurd. Especially in today’s cybersecurity scenario..