Helvetet
  • Communities
  • Create Post
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
pdxfed@lemmy.world to Cybersecurity@sh.itjust.worksEnglish · 19 hours ago

2 Carmakers left a hidden admin console on their login servers with its factory-default password. Researchers used it to take over any owner's account, then locate, unlock and start their car.

samcurry.net

external-link
message-square
22
link
fedilink
199
external-link

2 Carmakers left a hidden admin console on their login servers with its factory-default password. Researchers used it to take over any owner's account, then locate, unlock and start their car.

samcurry.net

pdxfed@lemmy.world to Cybersecurity@sh.itjust.worksEnglish · 19 hours ago
message-square
22
link
fedilink
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access
samcurry.net
external-link
Shubham Shah and Sam Curry chained a ForgeRock WAF bypass into code execution on the identity systems of two automakers, then demonstrated remote vehicle control in the US.

cross-posted from: https://piefed.world/c/tech/p/1522408/2-carmakers-left-a-hidden-admin-console-on-their-login-servers-with-its-factory-default

alert-triangle
You must log in or register to comment.
  • zod000@lemmy.dbzer0.com
    link
    fedilink
    English
    arrow-up
    10
    ·
    9 hours ago

    I want a “dumb” car even more than I want a “dumb” TV or phone.

  • ramble81@lemmy.zip
    link
    fedilink
    English
    arrow-up
    68
    ·
    18 hours ago

    For anyone who doesn’t want to dig through the article, they obfuscated the manufacturers and didn’t name them.

    • tyler@programming.dev
      link
      fedilink
      English
      arrow-up
      44
      ·
      16 hours ago

      It’s Toyota/Lexus. There’s a video with the cars.

      • Volcanna@sh.itjust.works
        link
        fedilink
        English
        arrow-up
        3
        ·
        2 hours ago

        That does it, I’m never buying a Lexus!

    • DireTech@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      6
      arrow-down
      3
      ·
      17 hours ago

      Probably Hyundai/Kia since they already had a similar problem

      • tyler@programming.dev
        link
        fedilink
        English
        arrow-up
        27
        ·
        16 hours ago

        It’s Toyota/Lexus. And these researchers have hacked most brands, including bmw, Mercedes, ford, Honda, Acura, Kia, Hyundai, Nissan, Infiniti, rolls Royce, Ferrari, Porsche, Jaguar, and any car that has start with Sirius XM. https://samcurry.net/web-hackers-vs-the-auto-industry

        • wyldrstallyns@lemmy.dbzer0.com
          link
          fedilink
          English
          arrow-up
          8
          arrow-down
          1
          ·
          10 hours ago

          Worth noting that by the time Ghost Dog came out, those handheld unlock devices were already in use. Remote lock/start hasn’t been a secure feature at any point. ☝🏼

          • MinnesotaGoddam@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            3 hours ago

            handheld unlock devices

            the flipper or just keyfobs in general?

            • wyldrstallyns@lemmy.dbzer0.com
              link
              fedilink
              English
              arrow-up
              1
              arrow-down
              2
              ·
              2 hours ago

              The one he used in the movie (sorry, very minor spoiler) predates most of those. If memory serves, I first heard of keyless entry for cars in the mid-90s (late 80s for homes?) and it was maybe a year before cars were being boosted via roll-jam/clone handhelds— essentially phreakboxes.

              I say “most” as keyless entry/start features weren’t widely offered, much less standard-ish until ~'00 and Ghost Dog came out in '99. I’m sure there are outliers, is all. 😉

  • GhostFish@piefed.social
    link
    fedilink
    English
    arrow-up
    1
    ·
    10 hours ago

    deleted by creator

  • Ninja876@lemmy.world
    link
    fedilink
    English
    arrow-up
    19
    arrow-down
    2
    ·
    19 hours ago

    You think the refrigerator temp changes is a big deal. How about starting a car in a garage and burning the house down…

    • LumpyPancakes@piefed.social
      link
      fedilink
      English
      arrow-up
      3
      ·
      11 hours ago

      Would the occupants die from carbon monoxide poisoning or would the car stall from lack of oxygen.

      Not sure it’s possible to carry carbon monoxide poisoning any more as the catalytic converter is supposed to remove it.

      • Ninja876@lemmy.world
        link
        fedilink
        English
        arrow-up
        1
        ·
        7 hours ago

        People till self delete using a car and a garage so its possible.

    • Peffse@lemmy.world
      link
      fedilink
      English
      arrow-up
      25
      ·
      18 hours ago

      Image

      • MinnesotaGoddam@lemmy.world
        link
        fedilink
        English
        arrow-up
        2
        ·
        3 hours ago

      • rmean@feddit.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        16 hours ago

        This is really a funny read!

        • pishadoot@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          7
          ·
          12 hours ago

          It’s from Weekly World News, an old tabloid chalk full of ridiculous stories like this, if you want to find more.

          I loved it when I was younger, bought it at the grocery or newspaper stand every issue.

          Best part was when I found out people actually believed the crap in it, it was so obviously dumb fake crap but man, people really took it like a newspaper.

          • IphtashuFitz@lemmy.world
            link
            fedilink
            English
            arrow-up
            4
            ·
            9 hours ago

            Bat Boy lives!

          • gramie@lemmy.ca
            link
            fedilink
            English
            arrow-up
            3
            ·
            10 hours ago

            My absolute favorite was not a story in the Weekly World News, but an ad on the back page. It was selling vials of water that could completely remove an evil eye curse “as if it never existed”.

          • Joejoebinkz1@sh.itjust.works
            link
            fedilink
            English
            arrow-up
            1
            ·
            11 hours ago

            “Pregnant Man Gives Birth”…That’s a fact!

    • 「黃家駒 Wong Ka Kui」@piefed.ca
      link
      fedilink
      English
      arrow-up
      5
      ·
      19 hours ago

      Behold! AI-Powered Nukes!
      Coming soon 2027!

      • aev_software@programming.dev
        link
        fedilink
        English
        arrow-up
        2
        ·
        10 hours ago

        Oh dear. Don’t tell our war-monger in-chief…

  • Wren@piefed.social
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    4
    ·
    13 hours ago

    “Researchers”

Cybersecurity@sh.itjust.works

cybersecurity@sh.itjust.works

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !cybersecurity@sh.itjust.works

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

  • Be respectful. Everyone should feel welcome here.
  • No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
  • No Ads / Spamming.
  • No pornography.

Community Rules

  • Idk, keep it semi-professional?
  • Nothing illegal. We’re all ethical here.
  • Rules will be added/redefined as necessary.

If you ask someone to hack your “friends” socials you’re just going to get banned so don’t do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 277 users / day
  • 142 users / week
  • 652 users / month
  • 3.77K users / 6 months
  • 2 local subscribers
  • 10.8K subscribers
  • 5.67K Posts
  • 8.28K Comments
  • Modlog
  • mods:
  • Kid@sh.itjust.works
  • Lanky_Pomegranate530@midwest.social
  • BE: 0.19.21
  • Modlog
  • Instances
  • Docs
  • Code
  • join-lemmy.org