Top luxury cars, including Mercedes and Ferrari, are said to have major security flaws. These flaws could potentially lead to data theft and also unlock and start cars without the owner knowing. Techradar reported that almost two-dozen car brands are affected by these flaws. These brands include – BMW, Roll Royce, Mercedes-Benz, Ferrari, Porsche, Jaguar, Land Rover, Ford, KIA, Honda, Infiniti, Nissan, Acura, Hyundai, Toyota, and Genesis.
Also, the car manufacturers, car technology makers Spireon and Reviver were also impacted, as well as streaming service providers, SiriusXM. These flaws were discovered by cybersecurity researcher Sam Curry who has a history of discovering security flaws in connected cars. In early December 2022, he discovered a flaw in SiriusXM that enabled threat actors to access connected vehicles.
Here, various manufacturers had different vulnerabilities. BMW and Mercedes-Benz have had flawed Single-sign-on(SSO) features that allowed threat actors to access internal systems, giving them access to GitHub instances, private chats, servers, AWS instances, and more. With BMW, potential attackers could have gotten access to internal dealer portals, car VIN numbers, as well as sales documents with sensitive owner details
Other than the two automakers, the owners of KIA, Honda, Infiniti, Nissan, Acura, Mercedes-Benz, Hyundai, Genesis, BMW, Roll Royce, Ferrari, Ford, Porsche, and Toyota cars, could have had their personally identifiable information (PII) leaked.
Other automakers
Ferrari was also heavily affected, as the SSO flaw allowed threat actors to access, modify, or delete, any Ferrari customer account. They could have even set themselves as car owners. With Porsche, flaws in its telematic systems allowed threat actors to pinpoint the exact location of the cars, and even send commands to the vehicles.
All of the impacted vendors were notified of the findings, and have since fixed the flaws. GPS vehicle tracking provider Spireon, allegedly used in more than 15 million vehicles, carried a flaw which, among other things, allowed threat actors to unlock the cars, start the engine, or disable the starter. To protect against such flaws in the future, researchers suggest vehicle owners store as little personal information in vehicles and mobile companion apps as possible. And possibly use a different mail ID as personal and the one used for vehicles, just to be cautious. However, automakers are working on avoiding all these instances. These flaws are needed to be removed, especially if automakers are going for autonomous vehicles. With tech flaws unlocking doors, it shouldn’t be able to drive on its own based on somebody else’s control.
