{
  "id": 19215990,
  "title": "Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns",
  "url": "https://urgent.news/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T17:31:00.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns/5308483"
  },
  "original_language": "en",
  "account": "Researchers discovered vulnerabilities in Android apps from two major automakers that allowed them to remotely access connected vehicles. By exploiting weaknesses in the ForgeRock identity platform, they were able to gain remote control over vehicles in Australia and the US, issuing commands such as starting engines, activating headlights, and sounding horns. The researchers, Shubham Shah and Sam Curry, first obtained the vehicle identification number (VIN) through public licence plate checkers and used it to query internal APIs, which provided personal information and owner email addresses. They bypassed the WAF filtering by exploiting path traversal flaws and gained access to internal admin APIs using hardcoded credentials. This allowed them to mint authentication tokens and issue arbitrary commands to affected vehicles. The two automakers patched the vulnerabilities within two hours of receiving the report, but remained anonymous to avoid diverting security resources.",
  "summary": "Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Hacker News",
        "title": "Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars",
        "url": "https://urgent.news/2026/11/09/default-admin-admin-server-password-helps-researchers-hack-two",
        "published": "2026-11-09T11:27:53.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}