Car app admin panel flaw allowed remote vehicle control and data leaks
What happened
Security researcher Sam Curry and the author decompiled a carmaker's Android app and found its admintool admin subdomain reachable with an API key hardcoded in the JavaScript bundle. A license plate could be turned into a VIN lookup returning owner email and other personal data. Embedded admin credentials in an OpenIDM vendor JavaScript bundle, plus a user auth token, allowed remote unlock, horn and engine start. The report does not say whether the flaws were fixed.
Written by AI from the coverage · updated 13 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageUnlocking any car from X brand in most of the world
安全研究者 Sam Curry 与作者通过反编译某车企 App 的 APK，发现其管理后台 admintool 子域仅靠 JavaScript 包中硬编码的 API key 即可访问，可凭车牌号经 VIN 查到车主邮箱等 PII。他们进一步在 OpenIDM 实例的厂商 JavaScript 包中发现内嵌管理员凭据，而拿到用户 auth token 后即可远程解锁、鸣笛、启动车辆。
Heat over time
Heat now 7·Comparable peak 10（Nov 9 09:00）·Comparable change over 24 hours –
The trend only compares accounts observed without gaps, so its range may be smaller than the current heat. Hover or tap the chart for each hour; the left and right arrow keys step through it.