Researcher unlocks any car from X brand worldwide
The gist
Security researchers Sam Curry and Shubham Shah said default credentials on two automakers' login servers let them unlock and start cars.
The automakers asked not to be named, so owners can't tell if their car was affected.
How it unfolded
- 2023Shubham Shah bought a new four-wheel-drive/SUV from the automaker, his first access to its connected car platform.
- Early 2026The researchers' work on the two automakers' login servers dates from this period.
- Nov 7, 2026Sam Curry and Shubham Shah published the details on Curry's blog.
Key terms
- default credentials
- A pre-set username and password supplied with a device for initial setup or after a factory reset.
- ForgeRock
- An identity and access management software company that provides authentication and identity platforms.
- OpenAM/OpenIDM
- Open-source access management and identity server software used for authentication and federation.
Source: Wikipedia