Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Ferrari, BMW, Toyota, Ford, and other automotive companies have been found to have severe vulnerabilities. The disclosed vulnerabilities varied based on the manufacturer and their specifics.
Researchers revealed that an AT&T system was fully compromised and, if exploited by threat actors, this flaw could be used to send and receive text messages, retrieve live geolocation, and disable hundreds of millions of SIM cards in Teslas, Subarus, Toyotas, and Mazdas, among others.
The impact of this vulnerability went far beyond the scope of car hacking and affected nearly every industry (nearly anything which uses a SIM card).
The Findings
The largest device-independent telematics company in North America, Spireon, discovered vulnerabilities including remote code execution on core systems for managing 1.2 million users; full administrative access to a company-wide administration panel that could be used to send arbitrary commands to 15.5 million vehicles and navigate location; the ability to fully control any vehicle, including police cars and ambulances.
Further on the researcher`s list of vulnerabilities, the flaws uncovered for Mercedes-Benz’s included remote code execution on multiple systems, as well as improperly configured single sign-on (SSO) that provided access to many critical internal applications, and memory leaks that could lead to account access.
Additionally, BMW and Rolls Royce, both owned by the BMW Group, had core SSO vulnerabilities, which allowed researchers to access employee applications.
Ferrari was also observed lacking access control allowing a potential attacker to manage employee “back office” administrator user accounts and having vulnerabilities, which could further lead to access of all Ferrari customer records or even account takeover for any Ferrari customer account.
As Cybernews reports, the researchers found that Toyota Financial’s Insecure Direct Object References (IDOR), which is a vulnerability caused by broken access controls in web applications. In this case, the vulnerability can be exploited to disclose the name, phone number, email address, and loan status of any Toyota financial customer.
For Hyundai, the report mentions fully remote lock/unlock, engine start/stop, precision locate, flash headlights, and honk vehicles using only the victim email address, as well as fully remote account takeover and PII disclosure via email address.
Ford was observed having the potential customer account takeover via improper URL parsing, and full memory disclosure on customer PII and access tokens for tracking and executing commands on vehicles, as well as configuration credentials used for internal services related to Telematics.
Other automotive giants with discovered vulnerabilities include SiriusXM, Reviver, Jaguar, Porsche, Land Rover, Kia, Honda, Infiniti, Nissan, and Acura. The full report can be found here.
