Top Tweets for #Carhack

🚨 Subaru Starlink Vulnerability Exposed: Remote Car Hijacking Risk 🚨 Security researchers Sam Curry and Shubham Shah uncovered a critical flaw in Subaru's Starlink service, which could let attackers track, control, and hijack vehicles across the US, Canada, and Japan using only a license plate. 🔍 Key Details: Vulnerability Origin: A misconfigured resetPassword.json API endpoint allowed arbitrary account takeovers. Exploitation Potential:Remote start/stop, lock/unlock, and vehicle tracking. Access to PII, billing info, vehicle PIN, and emergency contacts. Retrieval of location history for over a year (updated with engine starts). Attack Requirements: Knowledge of the victim's last name, ZIP code, email, phone number, or license plate. 🚗 Demonstrated Attack: Researchers bypassed Subaru's admin portal 2FA via client-side manipulation, gaining unrestricted access to vehicles. Tested successfully with a friend's Subaru, confirming the flaw's severity. 🛡️ Resolution: Subaru patched the vulnerability within 24 hours after receiving the report. No evidence of exploitation prior to the patch. ⚠️ Similar Case: A comparable flaw in Kia's dealer portal exposed millions of vehicles made since 2013 to potential theft using license plates. 📌 Mitigation Steps for Car Owners: Update Apps: Always keep vehicle and connected apps updated to receive security patches. Enable 2FA: Where available, ensure multi-factor authentication is active. Limit Data Sharing: Avoid publicly displaying license plates in digital posts or forums. Monitor Accounts: Regularly check for suspicious activity on connected services. 💡 Cybersecurity Takeaway: The IoT automotive industry must enhance API and account security to safeguard against evolving threats in connected vehicles. Read more : https://t.co/sKJAd2Cs87