Admin creds left in carmaker app opened doors to vehicles

Security researchers say a carmaker left administrator credentials for its central identity platform inside the smartphone app it distributes to customers, which provide a path to remotely unlock and start vehicles.

Working with United States based researcher Sam Curry, Shubham "Shubs" Shah in Sydney was able to establish an exploit chain that started with the number plate of a vehicle and led to remote access to the car.

In doing so, the researchers discovered that the carmaker behind two brands had left credentials, for the ForgeRock OpenIDM system that manages every account on the company's connected car platform, in a vendor JavaScript file.

Everyone who downloaded the carmaker's Android app was given the file with the credentials.

The credentials were nominally scoped to a staging environment, yet worked against production and the live customer directory behind it, Shah and Curry said.

Exploiting it against a specific car started with the car's number plate, which in turn yielded its vehicle identification number (VIN).

From there the researchers unravelled vulnerabilities that were easier to exploit in the carmaker's Australian site than its United States one, they said.

The remote vehicle access obtained allowed the researchers to remotely unlock, start and stop vehicles, among other actions.

Getting to that level of access was "definitely a lot harder" in the United States, Shah told iTnews.

Compared to Australia, the North American operation of the unnamed vehicle brand had put in a great deal more effort to secure access with a web application firewall (WAF), forcing the researchers to bypass it with remote code execution.

In Australia, the firewall was weaker. The researchers did not need remote code execution to get past it and could then target individual cars.

One firewall-exposed endpoint returned password and PIN hashes, mobile push tokens, phone numbers and full names for queried accounts, Shah noted.

The researchers were also able to reset any user's password, skip multi-factor authentication (MFA) through an OAuth password grant, mint an app token for the account and issue the command that unlocked the car.

"Not sure how many other people would find this chain!" Shah said.

Shah and Curry were asked not to disclose the name of the carmaker, which sells two vehicle brands in Australia.

The carmaker in question did not reward Shah and Curry with any form of bug bounty or recognition but fixed the vulnerability within hours of it being reported.

"I'm sure there are other methods to unlock these cars, but the vector we had was fully remote and would affect any customer with the functionality enabled," Shah, co-founder of Australian security firm Assetnote, said.