Security researchers remotely controlled two automakers' cars through login system flaw

Security researchers Shubham Shah and Sam Curry published findings describing how they chained together several vulnerabilities in ForgeRock, a customer login system used by two unnamed automakers, to gain remote code execution on production servers handling customer sign-ins. By exploiting a path confusion bug and bypassing a web application firewall, the researchers found they could create a valid login session for any customer account. For vehicles connected to those accounts, that access level matched what the owner's official mobile app could do: tracking real-time location and vehicle data, locking and unlocking doors, and remotely starting or stopping the engine. The researchers tested their findings only against US-based accounts and vehicles, and did not name the affected automakers. Both companies fixed the vulnerability within roughly two hours of being notified and rotated any credentials that may have been exposed, limiting the practical impact of the discovery.

Why it matters

Demonstrates how a single login system flaw can escalate into full remote control of connected vehicles, raising stakes for automotive cybersecurity.

Source: Sam Curry