A group of ethical hackers has discovered serious security issues, ranging from security to personal data, in vehicles from as many as 16 different carmakers. The auto industry needs to get serious about securing both their apps and data.
Ethical hackers discovered at least 20 security flaws in as many as 16 different brands. These can be exploited to determine the location of cars, lock and unlock them, start and stop the engine, take over accounts and execute commands remotely.
The vulnerabilities include the application programming interfaces (api's) that car manufacturers rely on so that technology in cars can communicate with each other. The brands affected include Ford, Toyota, Mercedes, BMW, Porsche and Ferrari. 'We found a vulnerability at one car company and reported it. Then we went to another car company and it was exactly the same,' said Sam Curry, a security researcher who outlined the findings in a blog.
A key problem is that some car manufacturers rely on third-party api software instead of building the technology themselves, Ted Miracco tells US trade magazine CyberScoop. He is managing director of security firm Approov, which provides mobile cyber security services to car companies. 'A lot comes down to apis: everything wants to connect to everything. So there is a proliferation of api interfaces and a single mobile app can have dozens of api calls.'