Posts

A brief history of software vulnerabilities in vehicles (Update 2023)

/in

Updated in 2023:

  • 2023: Sam Curry: Web Hackers vs. The Auto Industry: Critical Vulnerabilities in Ferrari, BMW, Rolls Royce, Porsche, and More
    • Kia, Honda, Infiniti, Nissan, Acura
      • Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the VIN number
      • Fully remote account takeover and PII disclosure via VIN number (name, phone number, email address, physical address)
      • Ability to lock users out of remotely managing their vehicle, change ownership
        • For Kia’s specifically, we could remotely access the 360-view camera and view live images from the car
    • Mercedes-Benz
      • Access to hundreds of mission-critical internal applications via improperly configured SSO, including…
        • Multiple Github instances behind SSO
        • Company-wide internal chat tool, ability to join nearly any channel
        • SonarQube, Jenkins, misc. build servers
        • Internal cloud deployment services for managing AWS instances
        • Internal Vehicle related APIs
      • Remote Code Execution on multiple systems
      • Memory leaks leading to employee/customer PII disclosure, account access
    • Hyundai, Genesis
      • Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the victim email address
      • Fully remote account takeover and PII disclosure via victim email address (name, phone number, email address, physical address)
      • Ability to lock users out of remotely managing their vehicle, change ownership
    • BMW, Rolls Royce
      • Company-wide core SSO vulnerabilities which allowed us to access any employee application as any employee, allowed us to…
        • Access to internal dealer portals where you can query any VIN number to retrieve sales documents for BMW
        • Access any application locked behind SSO on behalf of any employee, including applications used by remote workers and dealerships
    • Ferrari
      • Full zero-interaction account takeover for any Ferrari customer account
      • IDOR to access all Ferrari customer records
      • Lack of access control allowing an attacker to create, modify, delete employee “back office” administrator user accounts and all user accounts with capabilities to modify Ferrari owned web pages through the CMS system
      • Ability to add HTTP routes on api.ferrari.com (rest-connectors) and view all existing rest-connectors and secrets associated with them (authorization headers)
    • Spireon
      • Multiple vulnerabilities, including:
        • Full administrator access to a company-wide administration panel with ability to send arbitrary commands to an estimated 15.5 million vehicles (unlock, start engine, disable starter, etc.), read any device location, and flash/update device firmware
        • Remote code execution on core systems for managing user accounts, devices, and fleets. Ability to access and manage all data across all of Spireon
        • Ability to fully takeover any fleet (this would’ve allowed us to track & shut off starters for police, ambulances, and law enforcement vehicles for a number of different large cities and dispatch commands to those vehicles, e.g. “navigate to this location”)
        • Full administrative access to all Spireon products, […]
        • In total, there were…
          • 15.5 million devices (mostly vehicles)
          • 1.2 million user accounts (end user accounts, fleet managers, etc.)
    • Ford
      • Full memory disclosure on production vehicle Telematics API discloses
        • Discloses customer PII and access tokens for tracking and executing commands on vehicles
        • Discloses configuration credentials used for internal services related to Telematics
        • Ability to authenticate into customer account and access all PII and perform actions against vehicles
      • Customer account takeover via improper URL parsing, allows an attacker to completely access victim account including vehicle portal
    • Reviver
      • Full super administrative access to manage all user accounts and vehicles for all Reviver connected vehicles. An attacker could perform the following:
        • Track the physical GPS location and manage the license plate for all Reviver customers (e.g. changing the slogan at the bottom of the license plate to arbitrary text)
        • Update any vehicle status to “STOLEN” which updates the license plate and informs authorities
        • Access all user records, including what vehicles people owned, their physical address, phone number, and email address
        • Access the fleet management functionality for any company, locate and manage all vehicles in a fleet
    • Porsche
      • Ability to send retrieve vehicle location, send vehicle commands, and retrieve customer information via vulnerabilities affecting the vehicle Telematics service
    • Toyota
      • IDOR on Toyota Financial that discloses the name, phone number, email address, and loan status of any Toyota financial customers
    • Jaguar, Land Rover
      • User account IDOR disclosing password hash, name, phone number, physical address, and vehicle information
    • SiriusXM
      • Leaked AWS keys with full organizational read/write S3 access, ability to retrieve all files including (what appeared to be) user databases, source code, and config files for Sirius

Car Hacking News Timeline 2017-2019 [1]

  • 2019: Hack of an OEM’s automotive cloud via third-party services and tier-1 supplier network
  • 2019: Memory vulnerability at a cloud provider exposed data incl. passwords, API keys, and tokens
  • 2019: A malware infection caused significant production disruption at a car parts manufacturer
  • 2019: Vehicle data exposed during registration allowed for remote denial-of-service attacks on cars
  • 2019: Malware infected the back end, making laptops installed in police cars unusable
  • 2018: An ex-employee breached the company network and downloaded large volumes of personal information
  • 2018: Cloud servers hacked and used for cryptomining
  • 2018: Researchers exploited vulnerabilities of some infotainment systems and gained control of microphones, speakers, and navigation systems
  • 2018: Security issues discovered in 13 car-sharing apps
  • 2018: Researchers demonstrated >10 vulnerabilities in various car models, gaining local and remote access to infotainment, telematics, and CAN buses
  • 2018: EV home chargers could be controlled by accessing the home Wi-Fi network
  • 2017: Rental car companies exposed personal data
  • 2017: Ransomware caused the stop of production across several plants

Car Hacking News Timeline 2002-2015 [2]

 

 

 

Sources:

  1. McKinsey – Cybersecurity in automotive
  2. https://www.iamthecavalry.org/domains/automotive/
  3. https://smart.gi-de.com/automotive/brief-history-car-hacking-2010-present/