Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars

The two researchers, Shubham Shah and Sam Curry, discovered that the login systems behind two car brands' mobile apps were vulnerable to a complete takeover. By exploiting a default password on the ForgeRock identity platform, they could access any customer's account and, for those with a connected car, unlock the doors and start the engine.

Both brands sign customers in through ForgeRock, an identity platform now part of Ping Identity. The researchers found that on the servers hosting this platform, an administrator console still used its documented default password of 'admin' for both the username and the password.

The console was blocked from the open internet, but the researchers found a way to bypass the web application firewall (WAF) that guards the site. By adding encoded slashes and extra characters to the web address, they made the edge treat the request as a harmless static file while the server treated it as the path to the administrator console.

Once inside the console, the researchers used a built-in scheduler to run small scripts that executed their own code on the identity server. This gave them a command prompt on the machine that holds the customer records for both brands' logins.

The customer records sat behind the same block as the console, but the researchers' code reached them from inside the server. They changed a target account's email address and password, then signed in as that customer through the normal app, receiving the same access tokens the real app uses.

Those tokens were the keys to the car. Using the account's own vehicle commands, the researchers unlocked the doors and started the engine of a test car, with the owner standing next to it, then stopped the engine and locked it again.

The researchers were careful about what they had shown. They reported being able to open a session for any customer account on the affected servers, but they ran the vehicle commands only on cars they owned or were allowed to use.

Shubham Shah also published a separate attack on the Australian systems behind the same brands. There, the way in was different: admin credentials for the identity server had been left in the app's code, intended for a test setup.

With both attacks together, the researchers said they could send unlock and engine-start commands to the brands' cars in Australia, the United States, and Canada.

The attack left little for an owner to notice. Changing the email and password did not log the owner out of their app, and the researchers could direct the account's alerts to their own phone, keeping them off the owner's phone.

The researchers put the real email address back after the test. Neither write-up says whether anyone else found or used the path before it was closed.

The brands' mistake was in how they ran ForgeRock, not a new bug in the product, so there is no CVE, the public ID that tracks a flaw, and no vendor advisory to follow.

The console and its default password have been documented for years, and the maker's production hardening guide already tells operators to remove the console or change its password before going live.

For teams running the same identity software, now sold as PingIDM, two checks matter: look for the Apache Felix console at /system/console, and remove it or change its default password.

Do not count on edge or WAF path rules to hide an admin page. A path the edge and the server read differently can slip past the rules, as it did here.

The two researchers have a long record of this kind of work, usually breaking into the web systems behind the apps rather than the cars themselves. They have shown remote access to vehicles from Honda, Kia, and Subaru, among others.