Default admin:admin password helps researchers hack two car apps
Original title: Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
Researchers used default ForgeRock admin credentials to access customer accounts and control test cars in the US and Australia.
Two car brands' mobile apps signed customers in through ForgeRock, now part of Ping Identity. Researchers found the Apache Felix admin console still used the default admin:admin credentials. They bypassed an edge protection by adding encoded slashes to reach the console. Inside they ran scripts to modify accounts and obtain access tokens. These tokens let them unlock and start engines on test cars owned by them. The systems were fixed shortly after disclosure. A similar issue in Australia came from credentials left in app code.
Unconfirmed: Whether anyone else found or used the path before it was closed
- Default admin:admin on Apache Felix console at /system/console
- Bypassed edge rules with encoded slashes
- Modified customer accounts for vehicle control
- Tested only on consenting owners' cars in US and Australia
- Brands fixed within hours of report
Impact: Access to customer accounts and vehicle commands
| Product | Affected | Fixed in |
|---|---|---|
| Ping Identity ForgeRock OpenIDM | — | shortly after report |
- 1.Remove Apache Felix console or change default password
- 2.Do not rely on edge protections for admin paths
- Vendors
- ping identity
- Products
- forge rock openidm
- Victims
- two automakers
- Countries
- united statesaustraliacanada
From the original article
4 min read at thehackernews.com
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.