GoKawiilResearchers remotely unlocked and started connected cars at two automakers
Security researchers Shubham Shah and Sam Curry found backend vulnerabilities in two unnamed automakers' connected-car systems that let them remotely unlock doors and start engines, while also exposing vehicle location, mileage, fuel level, door status and customer personal data. One automaker's U.S. vehicles were affected, while the other's cars in Australia, the U.S. and Canada were vulnerable to remote lock disengagement; a demo video suggests the second company may be Toyota, based on what appears to be a RAV4. Both companies used ForgeRock's authentication services, and the flaws have since been fixed.
GoKawiil's interpretation of the reporting above, not reported fact.
The findings highlight how fragile the backend infrastructure supporting connected-car apps can be, since a single poorly secured API or admin tool exposed millions of vehicles across continents to remote takeover of physical functions like doors and engines. It also underscores the risk of shared authentication vendors like ForgeRock being implemented inconsistently, which could mean similar weaknesses exist at other automakers using the same tools. The exposure of personal and vehicle data alongside physical controls suggests connected-car security testing may still lag behind the pace of feature rollout.
- Two unnamed automakers had backend flaws allowing remote unlocking and engine starts
- Vulnerabilities also leaked location, mileage, fuel, door status and personal data
- Both companies used ForgeRock authentication, with fixes applied after disclosure
Faraday Bag for Car Key Fob — With connected-car backend hacks exposing remote unlock and start vulnerabilities, it's a good reminder to shield your key fob's wireless signals when not driving. A Faraday bag blocks RFID/Bluetooth signals, helping guard against relay attacks and unauthorized access to your vehicle. It's a cheap, simple way to add a physical layer of security on top of whatever the automaker patches.
See Faraday Bag for Car Key Fob on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Bruno Ferreira, 2026-11-10
Published there as: “All net-connected vehicles from two major automakers allowed hackers to remotely unlock doors and start the engine”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.