Unlocking any car from X brand in most of the world

Warning: The video in the article contains VERY loud bleeps.

• infosecau · 4 hours ago

  Hi - I've fixed this and uploaded a replacement video with less loud beeps. Sorry about that.

  • exodust · 3 hours ago

    I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed. h264 is the better choice for short progressive download clips on websites if compatibility matters.

    • capitainenemo · 2 hours ago

      huh. plays fine for me in firefox stable on linux, and with no extensions in firefox. Do you mean OS extensions?

    • yobert · 2 hours ago

      H265 plays fine in firefox for me! No special extensions, just linux

For anyone who is trying to decipher the clunky title, it means "Unlocking vehicles from a major manufacturer, across the globe" The manufacturer is not disclosed.

• ryandrake · 3 hours ago

  Proper clickbait titles are more like “You wouldn’t believe the car brand we were able to unlock!” And when you click through, the article tells you. What advanced form of clickbait is this where the authors doesn’t even disclose the most important part of the story? Why is he protecting the car company by redacting the brand through the entire article?

  • topspin · 3 hours ago

    > Why is he protecting the car company He is not protecting the a car company. He is protecting himself.

    • charcircuit · 1 hour ago

      Both can be true.

Hyundai

• defrost · 5 hours ago

  Not if you take them (there are two security workers behind this) at their word: In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle. Hacking Two Automakers: ForgeRock Path Confusion, RCE, and Remote Vehicle Access (November 7, 2026) - By Shubham Shah and Sam Curry - https://samcurry.net/forgerock

  • stickfigure · 5 hours ago

    Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too. Why would they be so circumspect? Presumably the automaker has fixed this by now.

    • gruez · 5 hours ago

      Defamation/legal risk, even if such legal actions will be spurious

    • Nexxxeh · 5 hours ago

      It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...

      • tialaramex · 4 hours ago

        That article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art. Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse

    • defrost · 5 hours ago

      On the non-Australian side (the Sam Curry blog) After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles. and I suspect there may have been a ninja edit- I swear blind I read a throw away line about why they were keeping the company name suppressed an hour or so ago, now I cannot find it in either article. As I recall, they "normally would disclose" but "times are busy and security folks are hard pressed" (paraphrasing) - they were giving the auto folks a bit of leeway for a bit (likely by request).

• BatchJob · 5 hours ago

  The color scheme on the admin panel suggests Toyota.

Can anybody guess what automaker?

• owlninja · 5 hours ago

  Isuzu is my guess? They might be tied to https://whg-telematics.com.au (my guess at the redacted URL if it is even partially real in the post).

  • motionlessveloc · 2 hours ago

    Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.

• avianlyric · 5 hours ago

  LLM seems to think it’s Toyota/Lexus based on an open source alternative client[1] documenting the same APIs that appear in the blog post. A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary. [1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...

  • forgotTheLast · 4 hours ago

    Yes the car in the video looks like an RX350

    • landgenoot · 4 hours ago

      RAV4 is always in the top 10 of most stolen cars [1]. Maybe this is why. [1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...

  • Malp · 4 hours ago

    Looks like the XA50 AFAICT

    • oez · 4 hours ago

      Definitely XA50. My sister bought one last week, time to find the sim card....

• ddtaylor · 5 hours ago

  Why should we?

• joshuat · 4 hours ago

  From reputation alone, I would not be surprised if it were Kia/Hyundai. https://en.wikipedia.org/wiki/Kia_Challenge

This is a Rav4

It's extremely difficult to find, hire, and then put into the right position a competent security engineer. Meanwhile competent hackers grow on trees. I understand that mistakes here were silly, but that's not the point. The point is, security is fucking difficult. IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back. I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.

• macintux · 3 hours ago

  I’m questioning the need for connected cars in the first place. Perhaps we could revisit that trend.

  • joedwin · 3 hours ago

    considering cybercab and waymo . That trend is going nowhere

    • macintux · 3 hours ago

      Makes perfect sense for fully-automated vehicles that aren’t privately owned. Everything else, I think there’s an argument to be made. Not that I expect the argument to go anywhere.

  • trombuance · 2 hours ago

    The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.

    • macintux · 2 hours ago

      Yeah, I've decided that my 2022 vehicle is not only my first, but my last new car. I'll find a way to convert something older to electric if that becomes necessary.

      • boredatoms · 1 hour ago

        Maybe a Slate truck is of interest

  • 0xbadcafebee · 1 hour ago

    Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features. The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.

    • macintux · 1 hour ago

      I agree with the ideal end state being control over your data, but the hack described in this report points out that privacy isn't the only problem. You're trusting a central service with the ability to perform those actions on your behalf; if that service has any vulnerabilities, it doesn't matter how much control you have over your data.

• 0xbadcafebee · 1 hour ago

  > It's extremely difficult to find, hire, and then put into the right position a competent security engineer I disagree. There are quite a few talented security engineers out there that aren't employed. For some of them it's because they don't have impressive resumes or don't market themselves as such; let's assume that's on them. But the other reason there's not enough security engineers is companies don't consider security essential. I have worked at some big companies. All of them failed to implement basic security best practices. If there were any red teamers on staff, they only focused on one or two areas of the company. The reason is simple: paying for security doesn't generate revenue or increase your stock price. So business leaders don't care if it's insecure, so hiring managers don't hire security engineers.

  • nimih · 11 minutes ago

    Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.

• jaza · 1 hour ago

  Sounds like the automaker in question actually did plenty of things right - they put robust auth in place, they didn't roll their own auth / cryptography, they were most of the way there. Yes, security is difficult, but there are some simple rules that you don't need to be a security expert in order to adhere to (I'm definitely not one myself, I'm just a garden variety dev), and that these guys did not follow, in particular: - Never hard-code credentials (especially in front-end exposed code) - Never share credentials between environments (especially between prod and non-prod) And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.

• anonymous908213 · 1 hour ago

  > It's extremely difficult to find, hire, and then put into the right position a competent security engineer. It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.

• Barbing · 34 minutes ago

  I feel like that would be implemented in a way that leads to parts being disabled due to bugs. “No the last guy didn’t pay his O2 sensor bill!” Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts? Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages. (Prob cop out that one can say about any solution)

“Any car” is perhaps too strong a claim. If it is Toyota/Lexus, I will say that I don’t think my 2009 Camry has this issue. I am quite sure that the fourth-generation Hilux my brother has does not.

• msandford · 1 hour ago

  There's a certain year for each car where it's guaranteed to be untrue, and same for each mfg. I don't know if it's 2015 or 2010 or 2005 but I would imagine back around 2000 the vast majority of cars can't be remotely hacked. I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.

  • Infernal · 55 minutes ago

    Hah not only same message from me but exact same year too, end of the GMT800 and the TJ. Probably other stuff I’m forgetting.

Blue car in the background is a facelifted fifth gen RAV4. Obvious from the shape of the mirrors and headlight. Toyota/Lexus would align with the "both brands" remark. White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022... Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.

• winny314 · 3 hours ago

  Keeping information under wraps just encourages more security theater, like people believing that locks actually work to deter skilled attackers, whatsoever. They really don't. They deter casual attackers at best.

  • rogerrogerr · 1 hour ago

    This is probably less security theater and more not-getting-sued theater.

    • warrantisall · 7 minutes ago

      Sued for what? It's rather the manufacturer should be sued for selling insecure vehicles. And slapped by authorities too.

• NamlchakKhandro · 2 hours ago

  hah. protip... it's not a 2022 rav4. the bonnet gives it away

• madaxe_again · 2 hours ago

  Sicko here. Here's a Toyota door unlock beep. https://www.youtube.com/watch?v=yVdQd9UjAzA

I'm glad I bought a Corolla LE that does NOT have remote start. I still have to insert the key to start the engine. So much more secure.

I think automaker failed security the moment its cars connected to the internet

• lakeviewterrace · 2 hours ago

  GM was doing this 25 years ago. It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what. They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure. Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.

The byline says “security researcher”, but I didn’t find any mention of disclosure to the platform security team in the blog post. What gives?

• rafram · 2 hours ago

  The companion blog post from Sam Curry says the issues were reported and fixed within hours.

Just go wrench on your own car, like OP. You'll be amazed at all the funky ways you can gain access without a key. Not really secure, but difficult enough to prevent the casual shenanigans. This stuff predates the automotive IoT crisis too.

• chao- · 2 hours ago

  Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door (only attempt if you know that you're doing, so as to avoid damaging it). Tends to be far easier than accessing car. It may also run counter to expectations: The nicest (and second most expensive) place I have lived at had the worst locks. Makes you reflect on how, most of the time we rely on a baseline trust placed in most of the people around us.

  • briansm · 29 minutes ago

    Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power. Literally all of civilization is built on the back of that, and if it erodes then We're doomed.

  • JumpCrisscross · 15 minutes ago

    > nicest (and second most expensive) place I have lived at had the worst locks Did it have an alarm system?

The follow up/linked article at the bottom is worth a read too as it's the 'world-wide' part of it. Definitely a great read from both Sam and Shubs https://samcurry.net/forgerock?ref=shubs.io

Why GPT-5.6? Was this done before the release of GPT-6, or is there some difference in restrictions between the two?

• spockz · 10 minutes ago

  Daybreak blue (for defensive action) was for a long time a specific model selection, basically Sol 5.6. Later it became a toggle available for any 5.6 model. Last time I checked it wasn’t available for 6+. Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.

Any lock can be picked. The article is an interesting read and the author found some obvious mistakes the company should not have made, but if it's a hack that takes weeks and multiple people to pull off, I wouldn't be too worried as an owner. Back in the non-nerd world of common criminals, some guy with a Stone Age brain simply smashes your window to grab whatever he can. Also take a look at how easily a professional could gain access to your home if they wanted to.

• lotsofpulp · 2 hours ago

  Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car? If PIN to drive is enabled, I assume it’s impossible to steal without towing it.

  • rogerrogerr · 1 hour ago

    I mean, it's probably possible, but it's well above the "just have to outrun the bear" bar: Towing it and/or just buying a car for yourself.

• Forgeties79 · 1 hour ago

  Honestly the “common criminal” walks up and down blocks trying handles until they find someone who didn’t lock up. Easiest targets by far. They used to pull radios more back in the day (it seems to be less common now?) but they generally just go through looking for change/cash anywhere or any valuables.

These always connected cars will soon become as bad, or likely worse, than the smartphones of today, which we don't really own and control, and always tracked. You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc. Evil.

And this, kids, is why we're not getting a "connected" car.