[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-two-automakers-connected-car-backends-had-remote-unlock-flaws":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12697,"two-automakers-connected-car-backends-had-remote-unlock-flaws","Two Automakers' Connected-Car Backends Had Remote-Unlock Flaws","Two researchers reported unlock-and-start flaws at two unnamed automakers, with a full attack chain published for only one of them in Australia.","Two security researchers say they found flaws in the servers behind two automakers' mobile apps that would let an attacker unlock doors and start engines remotely. Both flaws have been fixed.\n\nShubham Shah and Sam Curry did the work in early 2026 and have not named the companies. Automaker #1's affected vehicles were in the U.S. Automaker #2's were in Australia, the U.S. and Canada. Beyond unlocking and starting, the researchers said the flaws exposed vehicle location, mileage, fuel, range, door states and customers' personal information.\n\nThe step-by-step account covers only automaker #2's Australian system. Shah decompiled its Android app and found a telematics subdomain with an \"admintool\" page, reachable from the open internet. A JavaScript bundle on the backend contained the service's full functionality, plus hard-coded API keys and administrator credentials, probably meant for a staging environment. A web application firewall (a filter that restricts which URLs can be reached) stood in the way, but a \"pinService\" endpoint got through it.\n\nThe admin credentials exposed password hashes, which were SHA-512 and impractical to crack. The researchers then used an AI model to brute-force path names and found an unprotected one that let them overwrite any user's password. The Australian environment also let users skip multi-factor authentication entirely. That allowed them to mint access tokens, impersonate an account and send a \"door-unlock\" request, which opened a test car.\n\nThe pattern matters more than any single bug. Nobody picked a lock on the car itself. The weak point was ordinary web security: exposed admin pages, secrets shipped in code and a firewall covering for sloppy design underneath. When the phone app is the key, the account system is the lock.\n\nBoth automakers use ForgeRock for authentication and authorization. The researchers said that, with one small exception, the problems came from poor implementations rather than the product. That leaves an open question: how many other connected-car backends are configured with the same care?","[\"car-hacking\",\"connected-cars\",\"api-security\",\"vulnerabilities\"]","2026-11-10T10:50:00.000Z","2026-11-10T11:37:12.756Z","2026-11-10T11:37:12.919Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the meta-commentary ('The source account guessed the second might be Toyota...') and drop the Toyota speculation; make the headline, dek and lede match the evidence, since 'any car' and the dek's chain of flaws at 'two automakers' overreach when the detailed MFA skip, admin tool and password overwrite were shown only for automaker #2's Australian environment and the unlock was demonstrated on a test car.","resolved","security",[32,33,34,35],"car-hacking","connected-cars","api-security","vulnerabilities",[37],{"name":38,"url":39},"Tom's Hardware","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fcyber-security\u002Fall-net-connected-vehicles-from-two-major-automakers-allowed-hackers-to-remotely-unlock-doors-and-start-the-engine-now-patched-hard-coded-credentials-and-bypassed-mfa-security-showcase-a-lack-of-101-level-best-practices",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7144,"2026-11-12T13:27:45.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1128,"2026-11-11T18:05:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Deals","deals",642,"2026-11-12T14:00:00.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Policy","policy",619,"2026-11-12T12:53:36.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Consumer Tech","consumer-tech",364,"2026-11-12T11:12:32.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Hardware","hardware",336,"2026-11-12T11:24:43.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",230,"2026-11-12T10:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Software","software",168,"2026-11-11T17:36:49.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Startups","startups",159,"2026-11-11T12:30:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",118,"2026-11-11T16:49:42.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",107,"2026-11-12T10:09:03.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]