Security Researchers Uncover Default Password Vulnerability in Car Brands' Mobile Apps
Two security researchers have discovered a significant vulnerability in the login systems of car manufacturers' mobile apps, potentially exposing millions of customers' accounts and granting complete access to their vehicles.
The researchers, who prefer to remain anonymous, managed to gain complete control over the login systems of two major car brands' mobile apps. By exploiting the default 'admin:admin' server password, they were able to sign in and access any customer's account.
The car brands in question use ForgeRock, an identity platform now part of Ping Identity, to secure their mobile apps. Upon accessing the servers, the researchers found that the apps store customer data and vehicle information in an unencrypted format.
This vulnerability allows attackers to:
- Access and modify customer data
- Unlock and start the engine of a connected car for an owner
- Track a vehicle's location and movement
The researchers are now urging both car manufacturers to promptly address this critical security flaw and advise customers to change their login credentials to prevent unauthorized access to their accounts and vehicles.
This discovery highlights the importance of strong security measures in protecting personal data and vehicle information, as well as the potential risks associated with connected cars.
Recommendations
To mitigate the risks posed by this vulnerability, the researchers are offering the following recommendations:
- Car manufacturers should promptly patch the security flaw in their apps
- Customers should change their login credentials to protect their accounts and vehicles
By taking these actions, customers can minimize the risk of their personal data and vehicle information being accessed without their knowledge or consent.
Future Concerns
The discovery of this vulnerability raises concerns about the security of connected cars and the sensitive data they store and transmit.
As more cars become connected and offer remote access features, ensuring robust security measures is essential to protect both vehicle owners and their personal information.
Further research is needed to understand the extent of the issue and the potential impact on a larger scale.
Car Makers' Response
It remains unclear how the car makers will respond to the findings and address the vulnerability.
As car manufacturers continue to integrate advanced features into vehicles, addressing security concerns becomes increasingly important to protect drivers and passengers.
Speaking to Forbes, one of the researchers stated:
"We wanted to demonstrate how easily a hacker could gain access to a car owner's personal information and control their vehicle remotely."
The researchers have contacted both car manufacturers to alert them of the issue, but have not received a response as of yet.
This incident highlights the need for car makers to prioritize and implement stronger security measures to safeguard vehicle owners' data and control over their vehicles.
<small>Source: The Hacker News — read the original story there.</small>
