Photo credit: arstechnica.com

Subaru’s Security Flaws Exposed by Researchers

The investigation conducted by researchers Shah and Curry into the security vulnerabilities of Subaru began with an unexpected connection made through Curry’s mother’s Starlink app. They discovered that the app was linked to the domain SubaruCS.com, identified as a backend site for employee operations. Intrigued, they examined the site for potential security weaknesses and uncovered a grave flaw: they could reset employee passwords merely by inputting the associated email addresses.

While the password reset process required answers to two security questions, the validation of these answers occurred through code running in the user’s browser rather than on Subaru’s servers. This design flaw enabled the researchers to bypass the security checks seamlessly. Shah commented, “There were really multiple systemic failures that led to this.”

Upon identifying an email address belonging to a Subaru Starlink developer on LinkedIn, the pair successfully hijacked the account. Almost immediately, they gained access to sensitive information that allowed them to search for any Subaru owner by their last name, zip code, email address, phone number, or license plate number. This alarming level of access enabled them to reassess control over various Starlink functionalities linked to the owner’s vehicle, including the ability to remotely unlock the car, honk the horn, start the ignition, or pinpoint its location.

The implications of such vulnerabilities are significant, posing dangers related to theft and personal safety. Curry and Shah highlighted that malicious actors could feasibly track victims for stalking or thievery. They could pinpoint a vehicle’s location and unlock it at will, although a thief would need an additional method to override the car’s immobilizer system to drive it away without the proper key.

These hacking and tracking maneuvers are not isolated incidents. Last summer, Curry, alongside fellow researcher Neiko Rivera, demonstrated similar weaknesses in vehicles sold by Kia. Over the past two years, a wider collective of experts—including Curry and Shah—has revealed various web-oriented security vulnerabilities impacting numerous automotive brands such as Acura, BMW, Ferrari, Genesis, Honda, Hyundai, Infiniti, Mercedes-Benz, Nissan, Rolls Royce, and Toyota.

Source
arstechnica.com