Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.

Why would they be so circumspect? Presumably the automaker has fixed this by now.

▲ defrost 2 hours ago | parent | next [-]

On the non-Australian side (the Sam Curry blog)

  After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.

and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).

▲ Nexxxeh 2 hours ago | parent | prev | next [-]

It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...

	▲	tialaramex an hour ago \| parent [-]
		That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art. Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse

▲ gruez 2 hours ago | parent | prev [-]

Defamation/legal risk, even if such legal actions will be spurious

	▲	an hour ago \| parent [-]
		[deleted]