Researchers hack automaker Android apps to unlock and honk cars remotely

Tier D · Background noise – Good to know

Who’s exposed: Owners of connected cars from two major automakers

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Full takeover

The Brief

Security researchers exploited flaws in automakers' Android apps to gain remote access to connected cars from two major automakers.
The researchers were able to start engines, flash headlights and sound horns remotely.
Shubham Shah of Assetnote and researcher Sam Curry worked together on the research.

Why it matters

Remote vehicle features exposed through mobile apps can be abused if their backend and app authentication are weak, so developers of connected-car or similar IoT apps should review how remote commands are authorised.

The checklist behind the tier

Checklist · 1 of 10 yes

No	Hits tech teams	Judgment: consumer-facing automaker car apps, not developer, ops or IT tooling.
No	Core infrastructure	Judgment: individual automaker apps, not software nearly every team runs.
No	Popular tool	Judgment: two automakers' car apps are not a widely used developer framework, tool or platform.
No	Exploited in the wild	The Register: researchers exploited the flaws to demonstrate access; no real-world attacks reported.
No	Public exploit	The Register: no source says exploit code or a step-by-step proof-of-concept was published.
No	Remote, no login	The Register: remote access was gained, but the source does not say no credentials were needed.
Yes	Full takeover	The Register: researchers gained remote access to cars, allowing engine start, headlight flashing and horn sounding.
No	Secrets exposed	The Register: no source reports stolen credentials, tokens, keys, configs or customer data.
No	Supply chain	The Register: no source reports compromised packages, updates, pipelines or signing keys.
No	No fix yet	The Register: the source does not say whether the automakers have shipped a fix.

Source

Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns ↗ www.theregister.com - Articles · 4h ago

First seen 4h ago · 1 source · Full story page · How tiers are decided