Quote:A pair of hackers, Sam Curry and Shubham Shah, have exposed alarming security vulnerabilities within Subaru’s Starlink-connected infotainment system, enabling them to remotely take control of a Subaru Impreza. The duo gained unauthorized access to the vehicle through a compromised web portal linked to Subaru that allowed them to unlock the car, sound the horn, and start the ignition using any smartphone or computer.

Curry elaborated on their methods in a video and blog post, revealing that he simply reset the password of a Subaru employee’s account, thereby accessing a repository of location data that dated back over a year. The hackers noted that this data included precise records of the vehicle’s movements, down to specific parking spots. Subaru acknowledged the breach and stated that it has since patched the vulnerability, emphasizing its need to collect location data to assist in emergencies and vehicle recovery.

However, Curry and experts in the hacking community argue that automotive manufacturers have little justification for collecting extensive historical location data. They warn that the vulnerabilities they exploited are not exclusive to Subaru, claiming similar flaws exist in the systems of brands like Acura, Honda, Hyundai, Toyota, and more.

Continue Reading...