Ferrari, BMW, Toyota, Ford, and other automotive companies have been found to have severe vulnerabilities. The disclosed vulnerabilities varied based on the manufacturer and their specifics.

Researchers revealed that an AT&T system was fully compromised and, if exploited by threat actors, this flaw could be used to send and receive text messages, retrieve live geolocation, and disable hundreds of millions of SIM cards in Teslas, Subarus, Toyotas, and Mazdas, among others.

The impact of this vulnerability went far beyond the scope of car hacking and affected nearly every industry (nearly anything which uses a SIM card).


The Findings

The largest device-independent telematics company in North America, Spireon, discovered vulnerabilities including remote code execution on core systems for managing 1.2 million users; full administrative access to a company-wide administration panel that could be used to send arbitrary commands to 15.5 million vehicles and navigate location; the ability to fully control any vehicle, including police cars and ambulances.

Further on the researcher`s list of vulnerabilities, the flaws uncovered for Mercedes-Benz’s included remote code execution on multiple systems, as well as improperly configured single sign-on (SSO) that provided access to many critical internal applications, and memory leaks that could lead to account access.

Additionally, BMW and Rolls Royce, both owned by the BMW Group, had core SSO vulnerabilities, which allowed researchers to access employee applications.

Ferrari was also observed lacking access control allowing a potential attacker to manage employee “back office” administrator user accounts and having vulnerabilities, which could further lead to access of all Ferrari customer records or even account takeover for any Ferrari customer account.

As Cybernews reports, the researchers found that Toyota Financial’s Insecure Direct Object References (IDOR), which is a vulnerability caused by broken access controls in web applications. In this case, the vulnerability can be exploited to disclose the name, phone number, email address, and loan status of any Toyota financial customer.

For Hyundai, the report mentions fully remote lock/unlock, engine start/stop, precision locate, flash headlights, and honk vehicles using only the victim email address, as well as fully remote account takeover and PII disclosure via email address.

Ford was observed having the potential customer account takeover via improper URL parsing, and full memory disclosure on customer PII and access tokens for tracking and executing commands on vehicles, as well as configuration credentials used for internal services related to Telematics.

Other automotive giants with discovered vulnerabilities include SiriusXM, Reviver, Jaguar, Porsche, Land Rover, Kia, Honda, Infiniti, Nissan, and Acura. The full report can be found here.

If you liked this article, follow us on LinkedInTwitterFacebookYoutube, and Instagram for more cybersecurity news and topics.

New SiriusXM Vulnerability Allows Hackers to Unlock and Start Connected Cars Remotely

API Vulnerabilities: What Are These and How to Protect your Business Against Them

Vulnerability Assessment 101

Hackers Are Able to Unlock Honda Vehicles Remotely

Account Takeover Definition. Account Takeover Prevention

Leave a Reply

Your email address will not be published. Required fields are marked *