| ▲ | Unlocking any car from X brand in most of the world(shubs.io) |
| 25 points by infosecau an hour ago | 13 comments |
| |
|
| ▲ | PlaneSploit 32 minutes ago | parent | next [-] |
| Hyundai |
| |
| ▲ | defrost 24 minutes ago | parent | next [-] | | Not if you take them (there are two security workers behind this) at their word: In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock | | |
| ▲ | stickfigure 19 minutes ago | parent [-] | | Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too. Why would they be so circumspect? Presumably the automaker has fixed this by now. | | |
| ▲ | Nexxxeh 8 minutes ago | parent | next [-] | | It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef... | |
| ▲ | defrost 7 minutes ago | parent | prev | next [-] | | On the non-Australian side (the Sam Curry blog) After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request). | |
| ▲ | gruez 11 minutes ago | parent | prev [-] | | Defamation/legal risk, even if such legal actions will be spurious |
|
| |
| ▲ | BatchJob 6 minutes ago | parent | prev [-] | | The color scheme on the admin panel suggests Toyota. |
|
|
| ▲ | janice1999 42 minutes ago | parent | prev | next [-] |
| Warning: The video in the article contains VERY loud bleeps. |
|
| ▲ | the_real_cher 32 minutes ago | parent | prev | next [-] |
| Can anybody guess what automaker? |
| |
|
| ▲ | quantummagic 34 minutes ago | parent | prev [-] |
| For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed. |
