Remotely start..someone else’s car!

Probably the heading for this post was tricky enough to make anyone read through the following passage. But the truth is that I was able to execute this feat, SUCCESSFULLY!

I am not from the hard-core hacker community or a penetration tester who tries his best to break an application. I just had to open the App on my mobile, tap few screens and then viola, the German engine growls underneath the hood. I can Let’s get something straight here, I DID NOT –

·      Reverse engineer the mobile app and manipulate the internal workings

·      Execute a man-in-the middle attack to snoop in the commands that the App was sending to the car

·      Send a phishing email to the actual owner and track down the user credentials

·      Hack the car company’s datacenter to gather sensitive details

Of course, the company in question is reputed enough to gain that trust with us. So how did it all happen?

I would like to introduce a new term here - “Consumer Off-Boarding” and the significance of which would eventually sink in soon. Let me list down the facts:

§  I had owned THIS car initially – Brand new, just out of the dealership.

§  Enrolled into the company’s premium service to enable the connected car features – These were offered free during the purchase

§  Enrolled, configured and used these features as judiciously as possible

§  Decided to transfer the car (albeit reluctantly) to someone known to me

§  The company handled the entire transfer process

§  Kept the App still active on my mobile device

The issue in contention is the lack of process controls that eventually morphed itself into a security issue. The severity of this issue comes from the fact that passenger safety and life is at stake. There was high level of scrutiny during the onboarding process and ensure that I am the right owner of the vehicle and in possession of the car. But during the vehicle transfer process, the necessary triggers were missing to detect and remove my access to remote control the vehicle that ceased to be mine.

What is the solution?

o   Map the owner SSN to the car’s VIN.

o   Mobile app should prevent association of more than one user to a car

o   Location from which the request is originating could be a negative use case