Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
Not if you take them (there are two security workers behind this) at their word:
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock
Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
This is probably less security theater and more not-getting-sued theater.
Sicko here. Here's a Toyota door unlock beep. https://www.youtube.com/watch?v=yVdQd9UjAzA
hah. protip... it's not a 2022 rav4. the bonnet gives it away
These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
Hah not only same message from me but exact same year too, end of the GMT800 and the TJ. Probably other stuff I’m forgetting.
The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs
https://samcurry.net/forgerock?ref=shubs.io
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.
Literally all of civilization is built on the back of that, and if it erodes then We're doomed.
Warning: The video in the article contains VERY loud bleeps.
Hi - I've fixed this and uploaded a replacement video with less loud beeps. Sorry about that.
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
H265 plays fine in firefox for me! No special extensions, just linux
huh. plays fine for me in firefox stable on linux, and with no extensions in firefox. Do you mean OS extensions?
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
I mean, it's probably possible, but it's well above the "just have to outrun the bear" bar: Towing it and/or just buying a car for yourself.
Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.
This is a Rav4
I think automaker failed security the moment its cars connected to the internet
GM was doing this 25 years ago.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
> Why is he protecting the car company
He is not protecting the a car company. He is protecting himself.
Both can be true.
The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?
The companion blog post from Sam Curry says the issues were reported and fixed within hours.
And this, kids, is why we're not getting a "connected" car.
Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?
I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.
Hyundai
Not if you take them (there are two security workers behind this) at their word:
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerockCombined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
On the non-Australian side (the Sam Curry blog)
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
Defamation/legal risk, even if such legal actions will be spurious
The color scheme on the admin panel suggests Toyota.
Can anybody guess what automaker?
LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
Looks like the XA50 AFAICT
Definitely XA50. My sister bought one last week, time to find the sim card....
Yes the car in the video looks like an RX350
RAV4 is always in the top 10 of most stolen cars [1]. Maybe this is why.
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
Isuzu is my guess? They might be tied to https://whg-telematics.com.au (my guess at the redacted URL if it is even partially real in the post).
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
Why should we?
From reputation alone, I would not be surprised if it were Kia/Hyundai.
https://en.wikipedia.org/wiki/Kia_Challenge
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer.
It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.
I’m questioning the need for connected cars in the first place. Perhaps we could revisit that trend.
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
Maybe a Slate truck is of interest
Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.
The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.
I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem.
You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.
considering cybercab and waymo . That trend is going nowhere
Makes perfect sense for fully-automated vehicles that aren’t privately owned. Everything else, I think there’s an argument to be made.
Not that I expect the argument to go anywhere.
Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular:
- Never hard-code credentials (especially in front-end exposed code)
- Never share credentials between environments (especially between prod and non-prod)
And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.
> It's extremely difficult to find, hire, and then put into the right position a competent security engineer
I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them.
But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.
I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!”
Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?
Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)