Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns

Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US

Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns.

Shubham Shah, co-founder at Assetnote, and researcher Sam Curry worked together on the exploits earlier this year. By tinkering with the cars’ Android apps, they devised exploit paths to issue remote commands to vehicles in Australia and the US.

The pair published separate blogs covering different aspects of the research; Shah said the US attack "required a lot more work" because the automaker "spent much more time securing the US, Canadian, and European OpenIDM environments."

REG AD

Both exploit chains centered around weaknesses in the ForgeRock identity platform relied upon by both automakers, the identities of which were kept anonymous by the researchers, who have previously highlighted flaws in the likes of Hyundai, Kia, Subaru, and many others.

REG AD

In the Australian version of the app, the researchers first found a vehicle identification number (VIN) using public licence plate checkers, and used those in queries to internal APIs, which provided personal information and owner email addresses.

They also found hardcoded admin credentials for the ForgeRock OpenIDM that were meant for the staging environment but also worked in production. After bypassing the heavy WAF filtering by exploiting path traversal flaws, they were able to invoke the internal admin APIs and take over target accounts using only their email addresses.

This let them mint authentication tokens, which they could issue to send arbitrary commands to affected vehicles through the mobile app.

Issuing commands on the US version also required bypassing WAF filtering through a path traversal, though with a more involved technique: exploiting path confusion to reach the Apache Felix admin console.

The researchers used factory default credentials in Felix’s OSGi Web Console to gain admin privileges. They then used Felix configuration manager to schedule a task that executed an inline Groovy script, giving them shell access to the identity servers.

The researchers then queried local admin API endpoints, allowing them to view or modify user account data. From there, they logged into car owners’ accounts, and gained the ability to issue the same commands as demonstrated in the Australian version.

According to Curry’s disclosure timeline, he and Shah approached the affected automakers in "early 2026," and the exploits were patched within two hours of receiving the report.

Although the automakers wished to remain anonymous, it didn’t take long for some petrolheads to speculate that the partially blurred car in Shah’s demo video was a Toyota, citing the shape of the wing mirror and the unlock sound it made.

REG AD

Onlookers claimed that the two automakers in question were likely Toyota and its luxury brand Lexus. Asked wether the claims were accurate, a spokesperson for Toyota Motor Corporation neither confirmed nor denied them.

Curry said he and Shah chose to uphold the manufacturers’ requests to remain anonymous out of concern for infoseccers’ current workloads.

He said: "Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure." ®