Rendered at 04:26:30 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
ryukoposting 2 hours ago [-]
Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark.
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
winny314 1 hours ago [-]
Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.
hah. protip... it's not a 2022 rav4. the bonnet gives it away
intuitionist 2 hours ago [-]
“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.
msandford 5 minutes ago [-]
There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
memoriesofsmell 56 minutes ago [-]
The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs
Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.
lotsofpulp 27 minutes ago [-]
Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.
winny314 1 hours ago [-]
Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.
chao- 9 minutes ago [-]
Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks.
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
NooneAtAll5 2 hours ago [-]
I think automaker failed security the moment its cars connected to the internet
lakeviewterrace 54 minutes ago [-]
GM was doing this 25 years ago.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
janice1999 4 hours ago [-]
Warning: The video in the article contains VERY loud bleeps.
infosecau 3 hours ago [-]
Hi - I've fixed this and uploaded a replacement video with less loud beeps. Sorry about that.
exodust 1 hours ago [-]
I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
yobert 13 minutes ago [-]
H265 plays fine in firefox for me! No special extensions, just linux
capitainenemo 58 minutes ago [-]
huh. plays fine for me in firefox stable on linux, and with no extensions in firefox. Do you mean OS extensions?
netsharc 3 hours ago [-]
[flagged]
UqWBcuFx6NV4r 2 hours ago [-]
you would do yourself some good to learn to differentiate constructive criticism from this sort of mean vitriol. I have no doubt that this is the explanation for the downvotes. there is truly no need to be so abrasive. it only serves to detract from whatever good-faith intentions you had, if any.
Barbing 2 hours ago [-]
“Thanks for the nice write-up. Gotta admit the video still irks me. Like, portrait to landscape mid-recording… Since it was only a minute, think re-recording would be well worth it.”
Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?
AnonHP 1 hours ago [-]
The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?
rafram 1 hours ago [-]
The companion blog post from Sam Curry says the issues were reported and fixed within hours.
quantummagic 4 hours ago [-]
For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.
ryandrake 2 hours ago [-]
Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?
topspin 2 hours ago [-]
> Why is he protecting the car company
He is not protecting the a car company. He is protecting himself.
constantlm 3 hours ago [-]
This is a Rav4
PlaneSploit 4 hours ago [-]
Hyundai
defrost 3 hours ago [-]
Not if you take them (there are two security workers behind this) at their word:
In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.
Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock
stickfigure 3 hours ago [-]
Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
defrost 3 hours ago [-]
On the non-Australian side (the Sam Curry blog)
After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).
Nexxxeh 3 hours ago [-]
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
tialaramex 3 hours ago [-]
That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
gruez 3 hours ago [-]
Defamation/legal risk, even if such legal actions will be spurious
3 hours ago [-]
miohtama 3 hours ago [-]
[flagged]
BatchJob 3 hours ago [-]
The color scheme on the admin panel suggests Toyota.
UltraSane 2 hours ago [-]
I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.
the_real_cher 4 hours ago [-]
Can anybody guess what automaker?
avianlyric 3 hours ago [-]
LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post.
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
Isuzu is my guess? They might be tied to https://whg-telematics.com.au (my guess at the redacted URL if it is even partially real in the post).
motionlessveloc 36 minutes ago [-]
Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.
ddtaylor 3 hours ago [-]
Why should we?
joshuat 3 hours ago [-]
From reputation alone, I would not be surprised if it were Kia/Hyundai.
It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult.
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
macintux 2 hours ago [-]
I’m questioning the need for connected cars in the first place. Perhaps we could revisit that trend.
trombuance 55 minutes ago [-]
The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.
macintux 10 minutes ago [-]
Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.
joedwin 1 hours ago [-]
considering cybercab and waymo . That trend is going nowhere
macintux 1 hours ago [-]
Makes perfect sense for fully-automated vehicles that aren’t privately owned. Everything else, I think there’s an argument to be made.
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
https://samcurry.net/forgerock?ref=shubs.io
Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
He is not protecting the a car company. He is protecting himself.
Why would they be so circumspect? Presumably the automaker has fixed this by now.
Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.
[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...
[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...
https://en.wikipedia.org/wiki/Kia_Challenge
IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.
I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.
Not that I expect the argument to go anywhere.