Researchers disclose account takeover that enabled remote car commands

Security researchers Shubs and Sam Curry disclosed flaws that they say enabled remote commands, including unlocking doors and starting engines, on an unnamed automaker's vehicles in Australia, the United States and Canada. Shubs described testing on vehicles they owned or had permission to access. In Australia, the researchers linked vehicle registration information to customer accounts, found embedded administrator credentials, bypassed a web application firewall and reset account passwords. A separate authentication misconfiguration let them bypass multifactor authentication and obtain app access tokens. The US and Canadian systems required a different, more complex attack chain.