Default OpenIDM admin password let researchers unlock and start cars
Two unnamed brands fixed the consoles in about two hours; a permitted test also exposed location and telemetry.
Stories per day · 30 days
2 RSS
Relatedforgerock3default-credentials2openidm2account-takeover1admin-tool1android1automotive1automotive-security1car-hacking1path-traversal1ping-identity1remote-code-execution1telematics1waf-bypass1
8 stories, newest first · one card per story
Stories tagged #connected-cars
Researchers remotely commanded cars through two automakers’ Android apps
Chains used ForgeRock defaults and WAF path-traversal bypasses; both unnamed automakers patched within two hours of disclosure.
Researcher demonstrates remote car unlocking via admin tools
Decompilation reveals admin interfaces and identity bypasses allowing remote vehicle control from number plates.
1
Connected Cars Are a Surveillance Platform
Consumer Reports and Northeastern found connected cars share driving data with insurers, brokers, and agencies.
1
Some car apps are slipping owners’ data to big tech companies
Researchers found car apps sending VINs, emails, and location to advertising and analytics firms.
3
Automakers routinely share personally identifiable connected-car data with third parties, report says
Researchers say most automakers share connected-car personal data with advertisers and brokers.
3
Your car’s app could be telling Big Tech who you are and where you go
Northeastern and Consumer Reports found 19 of 21 cars and 7 of 30 companion apps send data to advertising and tracking domains.
3
A BYD Shark 6 Hack Shows the Risks of Connected Cars
Researcher remotely hacked a BYD Shark 6, controlling lights, wipers and doors and eavesdropping via cabin microphone, exposing connected-car security gaps.
6