Critical flaws found in Ferrari, Mercedes, BMW, Porsche, and other carmakers

BMW, Mercedes, Toyota, and other popular carmakers use vulnerable APIs that could have allowed attackers to perform malicious activities.

Cybersecurity researcher Sam Curry and his colleagues discovered many vulnerabilities in the vehicles manufactured by tens of carmakers and services implemented by vehicle solutions providers.

The vulnerabilities could have been exploited by threat actors to perform a broad range of malicious activities, from unlocking cars to tracking them.

The flaws discovered by the experts affected vehicles of popular brands, including Kia, Honda, Infiniti, Nissan, Acura, Mercedes-Benz, Genesis, BMW, Rolls Royce, Ferrari, Ford, Porsche, Toyota, Jaguar, Land Rover. The research team also discovered flaws in the services provided by Reviver, SiriusXM, and Spireon.

The exploitation of some flaws gave the experts access to hundreds of Mercedes mission-critical internal applications via improperly configured SSO. An attacker could have also exploited them to achieve remote code execution on multiple systems. The flaws also allowed attackers to access to the content of the memory of some systems, leading to the exposure of Mercedes’ employee/customer PII.

In the case of BMW and Rolls Royce, experts found SSO vulnerabilities which allowed them to access any employee application as any employee. The experts were able to access to internal dealer portals and retrieve sales documents for BMW by providing VIN numbers.

The experts were also able to access any application locked behind SSO on behalf of any employee, including applications used by remote workers and dealerships.

“While testing BMW assets, we identified a custom SSO portal for employees and contractors of BMW. This was super interesting to us, as any vulnerabilities identified here could potentially allow an attacker to compromise any account connected to all of BMWs assets. For instance, if a dealer wanted to access the dealer portal at a physical BMW dealership, they would have to authenticate through this portal. Additionally, this SSO portal was used to access internal tools and related devops infrastructure.” reads the analysis published by Curry. “To demonstrate the impact of the vulnerability, we simply Googled “BMW dealer portal” and used our account to access the dealer portal used by sales associates working at physical BMW and Rolls Royce dealerships.”

Experts were also able to achieve a full vehicle takeover on Kia via deprecated dealer portal

Some of the vulnerabilities discovered by the experts allowed the researchers to retrieve owner information, including the physical address, in other cases the flaws allowed tracking vehicles.

“Ability to send retrieve vehicle location, send vehicle commands, and retrieve customer information via vulnerabilities affecting the vehicle Telematics service” reads the analysis related to the issues impacting Porsche.

The experts also demonstrated how to exploit some flaws to access the Reviver license plate service and update any vehicle status to “STOLEN” which updates the license plate and informs the authorities.

The good news is that all the flaws discovered by the experts were addressed by the carmakers and service providers.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, carmakers)

[adrotate banner=”5″]

[adrotate banner=”13″]