Research: Luxury cars and emergency services vehicles vulnerable to remote takeover

Getty Images

A variety of automotive makers use devices that contains vulnerabilities that could enable threat actors to hack automobiles, steal purchaser details, or entire complete account takeovers, analysis has revealed.

Brand names which includes Ferrari, BMW, Rolls Royce, Mercedes-Benz, Porsche, and Ford have been observed critically susceptible to endpoint attacks, with flaws this kind of as inadequately-managed APIs and improper SSO configuration enabling lateral attacks and distant accessibility to motor vehicles.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Researchers also located big flaws in the code employed by telematics company Spireon, which delivers GPS companies for more than 15 million autos.

Using an SQL injection attack, Curry and his crew obtained remote obtain to all Spireon devices, made use of commonly by crisis companies autos, enabling them to perspective stay areas and remotely execute code to unlock and commence the engine of motor vehicles, for case in point.

Additional endpoint investigation and manipulation unveiled an admin dashboard with accessibility to the system’s 1.2 million user accounts, as effectively as car or truck identification quantities (VINs) and fleet spot details.

Vulnerabilities in Mercedes-Benz cars allowed for community registration on an associated motor vehicle repair site, and this account gave the researchers access to the Mercedes-Benz GitHub. 

Attackers could use this as a start pad for remote code execution, as very well as obtain to inner Mercedes-Benz communications channels and Amazon Web Providers (AWS) manage panels.

The findings ended up the end result of months of investigation by web application security researcher Sam Curry and many others, as specific in a entire report on his internet site.

Quite a few attacks could be executed with no any conversation with buyers at all. By seeking for domains less than “ferrari.com”, the staff found a range of subdomains this sort of as ‘api.ferrari.com’, ‘cms-supplier.ferrari.com’, ‘cms-new.ferrari.com’ and ‘cms-seller.take a look at.ferrari.com’.

While companies experienced applied solitary indicator-on (SSO) steps for these subdomains, Curry and his workforce located these had been flawed. By extracting the Ferrari SSO JavaScript code, they could determine the precise API routes that each individual utilized. Queries to Ferrari’s creation API permitted for information to be returned on any of the company’s clients.

Via this technique, attackers could obtain, modify, generate, or take out user accounts, as very well as change their account’s role to give them selves heightened positions or checklist them selves as a Ferrari operator. 

“Like quite a few other industries, the automotive industry has incorporated significant utilization of APIs across numerous of its general public expert services,” reported Yaniv Balmas, VP of study at Salt Security.

“We also encountered very similar issues with some of these auto brands and other individuals. We can validate these are not isolated situations and do not protect the whole attack area and current vulnerabilities. They do, having said that, display the depth and magnitude of the API adaptation issues.

“Rapid API adoption enables auto makers to publish additional operation to be utilised by car or truck homeowners, dealerships, and other individuals and is meant to provide a much better user encounter.

“However, human nature and heritage train us that, regrettably, usability will usually be prioritised about security and privacy – and the results are very properly proven by the report. We congratulate Sam Curry for publishing this superb research and highlighting the international API security issue.”

Household brands this sort of as Kia and Ford have been also identified lacking in security. Kia’s units permitted for remote access to vehicles like car cameras as a result of token manipulation, when an endpoint attack on Ford’s APIs granted command about buyer accounts and motor vehicle telematics.

Curry’s full report follows his November 2022 Twitter thread, which detailed the vulnerabilities that enabled distant hacking of Hyundai and Genesis cars via API exploitation.

The researchers have informed all the affected organizations of the vulnerabilities, which have considering that been mounted.