Security researchers demonstrated how default admin passwords, edge security bypasses, and scheduler code execution allowed them to compromise automotive identity platforms and remotely control connected vehicles.
How was access gained?
The companies were using an identity management platform that included an administrative console. In it, administrators had left the default username and password of "admin" enabled. Although this console was not supposed to be accessible from the internet, the researchers used special characters in the website address to bypass security filters.
Once they gained access to the console, they ran small programs that gave them control of the servers where customer data was stored. With this data, they changed the email and password to a test account, obtained the digital access keys, and used the app's normal functions to control the car.
What happened in practice?
Using the digital keys, the researchers were able to unlock the vehicle and start the engine. Changing the account details did not log the owner out of the app, and the researchers were even able to direct the vehicle’s notifications to their own device. This test was conducted in February 2026, in the presence of the test vehicle’s owner.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
Attacker used artificial intelligence to steal data from 11 countries
↗
In a second case, Shubham Shah found that on the same companies' systems in Australia, administrators had accidentally left administrative credentials inside the app code itself for testing purposes. Combining the above, the researchers reported that they were able to send commands to vehicles in the United States, Canada, and Australia.
The response of companies
The researchers reported the problem to the companies, and the systems were fixed within about two hours. The issue arose because administrators did not follow the manufacturer's basic security guidelines, which require changing default passwords or removing the management console before the system is fully operational. It is noted that the same researchers have previously identified similar problems in other automakers, such as Honda, Kia and Subaru.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)