Covered by 2 outlets — first reported by The Hacker News, Nov 9, 11:27 UTC
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
Summary
Two security researchers say they took over the login systems behind the mobile apps of two car brands by using a default administrator password, admin:admin, on the servers. The apps signed customers in through ForgeRock, an identity platform now part of Ping Identity. The researchers say this gave them access to any customer's account and, for owners of connected cars, let them unlock doors and start the engine on test cars.
AI summary by the SecurityTabs newsroom, checked against The Hacker News, Infosecurity Magazine. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Hacker NewsFirst report
Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the…
Infosecurity Magazine
Default Admin Password Let Researchers Unlock and Start Cars
Default admin password on automaker login servers let researchers unlock and start test cars