Security researchers remotely controlled vehicles from two major automakers earlier this year by exploiting flaws in their Android apps, starting engines and honking horns. Shubham Shah, co-founder at Assetnote, and researcher Sam Curry devised exploit paths targeting cars in Australia and the United States.
Shah and Curry, who have previously highlighted security flaws in systems from Hyundai, Kia, and Subaru, built their exploits around weaknesses in the ForgeRock identity platform relied on by both manufacturers, who have asked to remain anonymous.
The Australian attack chain began with the researchers obtaining a vehicle identification number from public licence plate checkers. They used this to query internal APIs, which returned personal information and owner email addresses. Hardcoded admin credentials for the ForgeRock OpenIDM, intended for a staging environment but active in production, were combined with path-traversal attacks that bypassed web application firewall filtering. This allowed the researchers to invoke internal admin APIs and take over target accounts using only email addresses, then mint authentication tokens they could use to send arbitrary commands to affected vehicles.
Shah said the US attack required more work because the automaker had spent more time securing its US, Canadian and European OpenIDM environments. The researchers bypassed the WAF through path confusion to reach an Apache Felix admin console, where they used factory default credentials to gain admin privileges. Using Felix's configuration manager, they scheduled a task executing an inline Groovy script that gave them shell access to the identity servers. From there, they queried local API endpoints, could view or modify user account data, logged into owners' accounts, and gained the ability to issue the same remote commands.
According to Curry's disclosure timeline, the researchers approached the automakers in early 2026. The exploits were patched within two hours of the report. Although the manufacturers wished to remain anonymous, online speculation, citing the shape of a wing mirror and the unlock sound in Shah's demo video, said the automakers were likely Toyota and its luxury brand Lexus. A Toyota spokesperson neither confirmed nor denied the claims.
Curry said he and Shah chose to uphold the automakers' requests for anonymity. He said: "Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure."
Analysis
Why This Matters
- The attacks demonstrate a direct path from mobile application vulnerabilities and identity platform misconfigurations to physical control of heavy machinery, underlining the intersection of digital security and automotive safety.
- The speed of the patch (within two hours) shows critical vulnerabilities can be resolved urgently, while highlighting the exposure present before disclosure.
- The combination of publicly accessible data (licence plates) and common security gaps (default credentials, staging-to-production credential leakage) represents a realistic attack vector for skilled adversaries.
Background
The researchers, Shubham Shah (Assetnote) and Sam Curry, have a track record of identifying vulnerabilities in connected vehicle systems, having previously disclosed flaws affecting Hyundai, Kia, Subaru, and several other manufacturers. The latest research centres on the ForgeRock identity platform widely used by enterprises, including automakers. The companies whose systems were exploited in this case are not named in the disclosure, but the vulnerabilities have been fully remediated.
Key Perspectives
Shah and Curry: Chose to withhold the names of the affected automakers despite normally advocating for full disclosure, citing the workload on security teams and a desire not to force the companies to divert resources from their current priorities.
Shah (on the US exploit): Noted that the attack required more effort because the automaker had invested significantly more time in securing its identity environments in the US, Canada, and Europe.
Toyota Motor Corporation: A spokesperson neither confirmed nor denied speculation that the company was one of the two anonymous automakers involved.
What to Watch
- Whether the identities of the two automakers are confirmed by further reporting or subsequent disclosures.
- How ForgeRock and other identity platform providers respond to the specific vulnerability classes demonstrated (path traversal, default credentials, staging-production mismanagement).
- Potential changes to security testing requirements or industry standards for connected-vehicle mobile applications and identity infrastructure.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedResearchers remotely controlled cars by exploiting flaws in automakers’ Android apps.www.theregister.com - Articles: “Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns.”
- SupportedWeaknesses in the ForgeRock identity platform were exploited to start engines and sound horns.www.theregister.com - Articles: “Both exploit chains centered around weaknesses in the ForgeRock identity platform relied upon by both automakers ... allowing them to start engines, flash headlights, and sound horns.”
- SupportedA Toyota spokesperson neither confirmed nor denied the claims that Toyota and Lexus were the automakers.www.theregister.com - Articles: “Asked wether the claims were accurate, a spokesperson for Toyota Motor Corporation neither confirmed nor denied them.”
- SupportedIn the Australian attack, researchers used VINs found through public licence plate checkers to query internal APIs, which returned personal information and owner email addresses.www.theregister.com - Articles: “the researchers first found a vehicle identification number (VIN) using public licence plate checkers, and used those in queries to internal APIs, which provided personal information and owner email addresses.”
- SupportedAustralian-attack ForgeRock admin credentials intended for staging also worked in production.www.theregister.com - Articles: “They also found hardcoded admin credentials for the ForgeRock OpenIDM that were meant for the staging environment but also worked in production.”
- SupportedIn the Australian attack, path-traversal flaws bypassed WAF filtering, allowing researchers to invoke internal admin APIs and take over accounts using email addresses.www.theregister.com - Articles: “After bypassing the heavy WAF filtering by exploiting path traversal flaws, they were able to invoke the internal admin APIs and take over target accounts using only their email addresses.”
- SupportedIn the US attack, researchers used path confusion to reach an Apache Felix admin console.www.theregister.com - Articles: “exploiting path confusion to reach the Apache Felix admin console.”
- SupportedIn the US attack, factory-default credentials and a scheduled Groovy-script task gave the researchers shell access to identity servers.www.theregister.com - Articles: “The researchers used factory default credentials in Felix’s OSGi Web Console to gain admin privileges. They then used Felix configuration manager to schedule a task that executed an inline Groovy script, giving them shell access to the identity servers.”
- SupportedCurry’s disclosure timeline says the researchers approached the automakers in early 2026.www.theregister.com - Articles: “According to Curry’s disclosure timeline, he and Shah approached the affected automakers in "early 2026,"”
- SupportedThe exploits were patched within two hours of the automakers receiving the report.www.theregister.com - Articles: “the exploits were patched within two hours of receiving the report.”
- SupportedOnline speculation identified Toyota and its luxury brand Lexus as the likely automakers, citing the wing mirror and unlock sound in Shah’s demo video.www.theregister.com - Articles: “Onlookers claimed that the two automakers in question were likely Toyota and its luxury brand Lexus.”
- SupportedCurry said: “Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure.”www.theregister.com - Articles: “He said: "Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure."”
