“Admin” password enabled remote access to two car brands

Researchers reached an administration panel behind a firewall

According to the researchers’ report, a firewall blocked direct access to the administration panel. However, differences in how the firewall and server interpreted the same web address allowed them to bypass that restriction. The panel they reached accepted “admin” as both the username and password.

These credentials belonged to the infrastructure’s administration panel, not the vehicle owner’s personal account. After gaining access to the server, the researchers changed the email address and password of an authorized test account and opened a new session in the mobile app.

Security guidance from Ping Identity, which owns the platform, recommends removing this panel from production systems or securing it by changing its credentials. Viewed alongside those recommendations, the configuration described in the report shows that the administration panel’s security was central to the incident.

The Australian finding involved a different route to access

In a separate report, Shah said administrator credentials created for a test environment had been embedded in a JavaScript file in an Australian system. The same credentials were found to work in the system serving customers. Using this method, the researchers unlocked an authorized test vehicle.

Shah says the two investigations together showed that remote commands could be sent to connected vehicles in the United States, Canada and Australia. However, the engine start described in the US tests and the door-unlocking test in Australia are separate findings. The public reports do not state when the Australian flaw was fixed or whether anyone other than the researchers used these methods.