mimiclem.me
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
pdxfed@lemmy.world to Cybersecurity@sh.itjust.worksEnglish · 10 hours ago

2 Carmakers left a hidden admin console on their login servers with its factory-default password. Researchers used it to take over any owner's account, then locate, unlock and start their car.

samcurry.net

external-link
message-square
12
link
fedilink
0
external-link

2 Carmakers left a hidden admin console on their login servers with its factory-default password. Researchers used it to take over any owner's account, then locate, unlock and start their car.

samcurry.net

pdxfed@lemmy.world to Cybersecurity@sh.itjust.worksEnglish · 10 hours ago
message-square
12
link
fedilink
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access
samcurry.net
external-link
Shubham Shah and Sam Curry chained a ForgeRock WAF bypass into code execution on the identity systems of two automakers, then demonstrated remote vehicle control in the US.

cross-posted from: https://piefed.world/c/tech/p/1522408/2-carmakers-left-a-hidden-admin-console-on-their-login-servers-with-its-factory-default

alert-triangle
You must log in or register to comment.
  • Wren@piefed.social
    link
    fedilink
    English
    arrow-up
    0
    ·
    3 hours ago

    “Researchers”

  • ramble81@lemmy.zip
    link
    fedilink
    English
    arrow-up
    0
    ·
    9 hours ago

    For anyone who doesn’t want to dig through the article, they obfuscated the manufacturers and didn’t name them.

    • tyler@programming.dev
      link
      fedilink
      English
      arrow-up
      0
      ·
      6 hours ago

      It’s Toyota/Lexus. There’s a video with the cars.

    • DireTech@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      0
      ·
      8 hours ago

      Probably Hyundai/Kia since they already had a similar problem

      • tyler@programming.dev
        link
        fedilink
        English
        arrow-up
        0
        ·
        6 hours ago

        It’s Toyota/Lexus. And these researchers have hacked most brands, including bmw, Mercedes, ford, Honda, Acura, Kia, Hyundai, Nissan, Infiniti, rolls Royce, Ferrari, Porsche, Jaguar, and any car that has start with Sirius XM. https://samcurry.net/web-hackers-vs-the-auto-industry

  • Ninja876@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    ·
    10 hours ago

    You think the refrigerator temp changes is a big deal. How about starting a car in a garage and burning the house down…

    • LumpyPancakes@piefed.social
      link
      fedilink
      English
      arrow-up
      0
      ·
      2 hours ago

      Would the occupants die from carbon monoxide poisoning or would the car stall from lack of oxygen.

      Not sure it’s possible to carry carbon monoxide poisoning any more as the catalytic converter is supposed to remove it.

    • Peffse@lemmy.world
      link
      fedilink
      English
      arrow-up
      0
      ·
      9 hours ago

      Image

      • rmean@feddit.org
        link
        fedilink
        English
        arrow-up
        0
        ·
        7 hours ago

        This is really a funny read!

        • pishadoot@sh.itjust.works
          link
          fedilink
          English
          arrow-up
          0
          ·
          3 hours ago

          It’s from Weekly World News, an old tabloid chalk full of ridiculous stories like this, if you want to find more.

          I loved it when I was younger, bought it at the grocery or newspaper stand every issue.

          Best part was when I found out people actually believed the crap in it, it was so obviously dumb fake crap but man, people really took it like a newspaper.

    • 「黃家駒 Wong Ka Kui」@piefed.ca
      link
      fedilink
      English
      arrow-up
      0
      ·
      10 hours ago

      Behold! AI-Powered Nukes!
      Coming soon 2027!

      • aev_software@programming.dev
        link
        fedilink
        English
        arrow-up
        0
        ·
        1 hour ago

        Oh dear. Don’t tell our war-monger in-chief…

Cybersecurity@sh.itjust.works

cybersecurity@sh.itjust.works

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: [email protected]

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

  • Be respectful. Everyone should feel welcome here.
  • No bigotry - including racism, sexism, ableism, homophobia, transphobia, or xenophobia.
  • No Ads / Spamming.
  • No pornography.

Community Rules

  • Idk, keep it semi-professional?
  • Nothing illegal. We’re all ethical here.
  • Rules will be added/redefined as necessary.

If you ask someone to hack your “friends” socials you’re just going to get banned so don’t do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities [email protected] [email protected] [email protected] [email protected] [email protected]

Notable mention to [email protected]

Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 12 users / day
  • 16 users / week
  • 74 users / month
  • 101 users / 6 months
  • 0 local subscribers
  • 10.8K subscribers
  • 93 Posts
  • 118 Comments
  • Modlog
  • mods:
  • Kid@sh.itjust.works
  • Lanky_Pomegranate530@midwest.social
  • BE: 0.19.20
  • Modlog
  • Instances
  • Docs
  • Code
  • join-lemmy.org