GoKawiilResearchers remotely unlocked and started connected cars at two automakers
Security researchers Shubham Shah and Sam Curry found backend vulnerabilities in two unnamed automakers' connected-car systems that let them remotely unlock doors and start engines, while also exposing vehicle location, mileage, fuel level, door status and customer personal data. One automaker's U.S. vehicles were affected, while the other's cars in Australia, the U.S. and Canada were vulnerable to remote lock disengagement; a demo video suggests the second company may be Toyota, based on what appears to be a RAV4. Both companies used ForgeRock's authentication services, and the flaws have since been fixed.