Ethical Hacking News
Researchers have successfully exploited weaknesses in Android apps used by major automakers, allowing them to remotely unlock cars, honk horns, and even start engines. The incident highlights the importance of robust security measures in Android apps used by connected cars.
Researchers exploited vulnerabilities in Android apps used by major automakers, including ForgeRock identity platform, to remotely unlock cars, honk horns, and start engines. The researchers used public license plate checkers to identify vehicle identification numbers and query internal APIs to gain access to cars' systems. Awareness of hardcoded admin credentials in production environments allowed them to take over target accounts and issue arbitrary commands to affected vehicles. The incident highlights the importance of robust security measures in Android apps used by connected cars and raises questions about automakers' responsibility to prioritize security.
A recent discovery has shed light on the potential risks of connected cars, highlighting the vulnerabilities of Android apps used by major automakers. Researchers, Shubham Shah and Sam Curry, have successfully exploited weaknesses in the ForgeRock identity platform, allowing them to remotely unlock cars, honk horns, and even start engines.
The researchers, who work at Assetnote and have previously highlighted flaws in various Android apps, used a combination of techniques to bypass security measures and gain access to the cars' systems. In the Australian version of the app, they first identified a vehicle identification number (VIN) using public license plate checkers and then used that information to query internal APIs, which provided personal information and owner email addresses. They also found hardcoded admin credentials for the ForgeRock OpenIDM that were meant for the staging environment but also worked in production.
Once inside, the researchers were able to invoke the internal admin APIs and take over target accounts using only their email addresses. They then minted authentication tokens, which they could issue to send arbitrary commands to affected vehicles through the mobile app. This allowed them to issue commands on both the Australian and US versions of the app, demonstrating the potential for remote exploitation of connected cars.
The researchers approached the affected automakers in early 2026 and the exploits were patched within two hours of receiving the report. However, the incident highlights the importance of robust security measures in Android apps used by connected cars.
The researchers chose to remain anonymous out of concern for the workload of infosec professionals. However, their discovery serves as a reminder of the need for robust security testing and vulnerability assessment in the automotive industry.
The incident also raises questions about the responsibility of automakers to prioritize security in their Android apps. While some may argue that the researchers' discovery is a wake-up call for the industry, others may see it as a reminder of the need for continued investment in security measures.
In any case, the discovery serves as a reminder of the potential risks of connected cars and the importance of robust security measures in Android apps used by the automotive industry.
Related Information:
https://www.ethicalhackingnews.com/articles/Exposing-the-Vulnerabilities-of-Connected-Cars-A-Cautionary-Tale-of-Android-App-Security-ehn.shtml
https://www.theregister.com/security/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns/5308483
Published: Mon Nov 9 13:26:48 2026 by llama3.2 3B Q4_K_M
