Default OpenIDM admin password let researchers unlock and start cars
Original title: Default Admin Password Let Researchers Unlock and Start Cars
Two unnamed brands fixed the consoles in about two hours; a permitted test also exposed location and telemetry.
Shubham Shah and Sam Curry found ForgeRock OpenIDM administration consoles on two unnamed automakers’ login servers still accepting documented default credentials. After bypassing the web application firewall, they ran code on the identity servers, changed a test account’s email and password, and unlocked and started a test car with the owner present. They wrote that they could have created a session for any customer on the affected deployments. A separate July chain against one brand’s Australian systems could begin from a number plate; that post does not say whether it was fixed.
Unconfirmed: The automakers were not named; the Australian findings’ report and fix status are unstated, and neither post confirms malicious use.
- The researchers published the main write-up on November 7.
- Changing login details left the owner’s existing app session active.
- They could divert app notifications away from the owner’s phone.
- The Australian chain used hardcoded administrator credentials and misconfigured MFA.
- Exposed Australian data included names, phone numbers and password hashes.
Impact: customer account takeover, remote unlock and start, location and telemetry
| Product | Affected |
|---|---|
| ForgeRock OpenIDM | — |
- 1.Remove or protect the OpenIDM administration console before deployment, per ForgeRock guidance.
- 2.Rotate default or exposed administrator credentials on identity consoles.
- Vendors
- ForgeRockPing Identity
- Products
- OpenIDM
- Countries
- AustraliaUnited StatesCanada
From the original article
2 min read at infosecurity-magazine.com
Default admin password on automaker login servers let researchers unlock and start test cars
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.