CybersecurityUpdated Yesterday

Embedded admin credentials and an MFA bypass reached car controls across one automaker’s two brands

Shah’s separate Australian write-up described a chain in one unnamed automaker’s connected-car systems, covering both of its brands. Administrator credentials were embedded in a vendor’s JavaScript bundle, and an MFA-bypass route helped the researchers gain app access and issue vehicle commands. This account covers one automaker and its two brands, rather than the two-automaker U.S. chain. Shah said testing was limited to cars he owned or had permission to interact with.

1 publisher1 report

Coverage started Yesterday