{
  "id": 19216313,
  "title": "Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns",
  "url": "https://urgent.news/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-19216313",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T17:31:00.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/11/09/researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns/5308483"
  },
  "original_language": "en",
  "account": "Security researchers from Assetnote, Shubham Shah and Sam Curry, discovered vulnerabilities in Android applications used by major automakers. By exploiting these flaws, the duo remotely accessed vehicles from two prominent car manufacturers, enabling them to perform various actions such as starting engines, flashing headlights, and sounding horns. The researchers worked together on the exploits, sharing their findings through separate blogs and blogs covering different aspects of the research.\n\nThe pair focused on weaknesses within the ForgeRock identity platform, which both automakers utilized for their connected car solutions. The researchers highlighted that the US attack required more extensive effort due to the automaker's greater emphasis on securing its OpenIDM environments in the United States, Canada, and Europe. The exploits centered around the ForgeRock identity platform, which the researchers had previously identified as a potential security risk in other automaker apps, including Hyundai, Kia, Subaru, and others.\n\nTo gain remote access, the researchers first obtained the vehicle identification number (VIN) using publicly available license plate checkers. They then used these VINs in queries to internal APIs, which provided personal information such as owner email addresses. By bypassing WAF filtering, the researchers accessed internal admin APIs using hardcoded credentials meant for the staging environment but functional in production. This allowed them to mint authentication tokens, which were used to send arbitrary commands to the affected vehicles through the mobile app.\n\nThe researchers employed various techniques to overcome WAF filtering, including path traversal methods. For the US version of the app, they exploited path confusion to reach the Apache Felix admin console and gained admin privileges using factory default credentials in Felix's OSGi Web Console. They then utilized the Felix configuration manager to schedule a task that executed an inline Groovy script, granting them shell access to the identity servers. From there, they queried local admin API endpoints, allowing them to view or modify user account data. Subsequently, the researchers logged into the owners' accounts, granting them the ability to issue commands simulating those demonstrated in the Australian version.\n\nCurry and Shah reported their findings to the automakers in early 2026, and the issues were patched within two hours of receiving the report. Despite the automakers' request for anonymity, the researchers faced speculation that the partially blurred car in Shah's demo video was a Toyota or Lexus, based on the shape of the wing mirror and the unlock sound. A Toyota spokesperson neither confirmed nor denied these claims. Curry and Shah chose to respect the manufacturers' wishes for anonymity due to concerns about information security professionals' workload during a busy time in the security landscape.",
  "summary": "Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Hacker News",
        "title": "Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars",
        "url": "https://urgent.news/2026/11/09/default-admin-admin-server-password-helps-researchers-hack-two",
        "published": "2026-11-09T11:27:53.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}