Researchers remotely unlock cars of major automaker in US and Australia
A security researcher reports that, with another researcher, he hacked a major automotive company earlier this year and remotely unlocked cars in the US and Australia. Technical writeups for both cases were published. The company is unnamed and no fix information is available.
What happened
A security researcher reports that, with another researcher, he hacked a major automotive company earlier this year and remotely unlocked cars in the US and Australia. Technical details were published in two writeups. The company has not been identified.
Why it matters
The flaw allowed cars to be opened remotely, without a key, exposing belongings inside vehicles and the vehicles themselves. Because the automaker is unnamed, any company with a fleet could be affected and would not yet know.
What to do
Ask your fleet vehicle vendor whether there is an outstanding security advisory about remote unlocking. Watch for the automaker to be identified and for any bulletins.
For the technical team
- Affected
- Sistemas de uma grande montadora não nomeada; carros nos EUA e na Austrália destraváveis remotamente · Systems of an unnamed major automotive company; cars in the US and Australia.
- Exploitation
- Demonstrated by researchers (@infosec_au with @samwcyo); writeups published for the Australia case and the US case. Sources report no malicious exploitation.
- Fix
- Sources give no fix information.
- Vector
- Component and flaw type not specified in the source. Researchers exploited systems of an unnamed major automotive company to remotely unlock cars in the US and Australia.
- More details
- According to the researcher, the hack happened earlier this year. Two technical writeups published, one per country. The automaker was not named in the post.
Timeline
Incident opened.
Sources 1 source
- @infosec_au @infosec_au
