Security · High impactFan score 2 · Tier D
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The Hacker News ·
The Brief
- Two security researchers found that the login systems behind two car brands' mobile apps could be taken over completely.
- The servers were reachable with the default 'admin:admin' credentials.
- An attacker could access any customer's account and, for a connected car, unlock the doors and start the engine.
Why it matters
Default credentials on backend systems can expose every customer account and the remote vehicle controls tied to them, so any service built with default logins is at risk.
Who’s affected
- Customers of the two affected automakers who own connected cars
- Engineering teams running similar app login backends
- #automotive
- #default-credentials
- #authentication
- #vulnerability
- #connected-cars
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through…