Researchers used default credentials to access connected-car accounts

Technology · First reported 9 Nov, 11:27 · Updated 11:58

Image: Wikimedia Commons · NASA Johnson Space Center · Public domain

Researchers said they exploited misconfigured identity systems used by two car brands’ apps to access customer accounts and, in permitted tests, unlock and start connected cars. The systems involved in the US tests were fixed about two hours after the researchers reported the issue.

The researchers found an exposed Apache Felix administrator console on the identity servers, protected by the documented default username and password, “admin.”
They used the console to access customer records, take over accounts, and issue unlock and engine-start commands during tests on cars they owned or had permission to use. [875a8d41-df0d-4d0d-4d8f-a98e-0e448a7e9a8f]
The researchers reported that the US systems were fixed about two hours after disclosure; the account also describes a separate attack on Australian systems, but gives no fix date for those systems.

Summary written by Lux AI from 2 articles

Key facts

Researchers: Shubham Shah and Sam Curry
Identity platform: ForgeRock, now part of Ping Identity
Default credentials: Username and password were both “admin”
US remediation: The systems were fixed about two hours after the researchers reported the problem
Regions cited: Australia, the United States, and Canada