WORLDTECHResearchers hijack connected cars through flawed Android app backends
Security researchers say they exploited weaknesses in Android applications to take remote control of connected vehicles from two major automakers. The account, first reported by The Register and relayed by SC Media, describes control over engine start, headlights and horns.
Attacks on vehicles in Australia and the US
According to the report, Shubham Shah and Sam Curry identified exploit routes that let them switch on engines, flash headlights and activate horns on vehicles in Australia and the United States.
In the Australian case, the researchers used vehicle identification numbers and administrative credentials embedded in the software to get past web application firewalls. They then minted authentication tokens that allowed them to issue commands.
A more involved route through identity servers
A second attack followed a more complicated course. It exploited path confusion to reach an Apache Felix console, then used default credentials to obtain shell access on identity servers.
The weaknesses, the report says, let the researchers change user account data and take over vehicle functions.
Disclosure and unnamed manufacturers
The researchers say they reported the findings to the affected companies in early 2026, and fixes were deployed within two hours. The report does not name the manufacturers.
Industry observers have speculated that the vehicles involved are Toyota and Lexus models, but this has not been confirmed.
Open questions
- Which two automakers are affected, given that they remain unnamed?
- Have the fixes been verified to close every attack path described?