Security exploit in Subaru automobile software allows hackers full access to vehicles
As the auto industry gets smarter and more connected, the number of security vulnerabilities grows. A new report details just how vulnerable connected cars can be.
A security researcher by the name of Sam Curry recently released a blog post detailing how he and a colleague (Shubham Shah) were able to compromise the Starlink software system used by Subaru cars. Starlink powers the infotainment center in Subaru vehicles and allows users to remotely control their registered cars, which can include remotely locking/unlocking the vehicle and starting it.
Curry explained that an exploit in the Subaru employee login page for the Starlink system allowed him to identify a valid employee email address, change the employee's password, and circumvent any kind of two-factor authentication to log in.
Once inside the Starlink system, Curry realized he could locate any registered Subaru vehicle via one of the following: a customer name, phone number, email address, or vehicle identification number (VIN). (Note that VINs can easily be found via a license plate.) Once a car was found, all of this information was ripe for the taking. Other available information included billing data, emergency contacts, and more.
Not only was this personal data easily attainable, but the vehicle's location history over the past year was also available and, according to Curry, easy to download and plot. This location data included a time stamp, the vehicle's odometer, and the GPS coordinates (accurate to within about 15 feet or 5 meters).
Perhaps most alarmingly, Curry was able to find a friend's car in the database and add his personal credentials as an authorized Starlink user to that vehicle. Once he was added, he could control the car remotely. This allowed him to lock and unlock the car, remotely start it, and determine its location. The affected Starlink user did not receive any notification that another user had been added to the car's Starlink account.
Subaru appears to have since patched the vulnerability, which Curry discovered in November 2024. To their credit, the car manufacturer issued a patch within 24 hours of receiving a report from Curry. Curry's post serves as a reminder that, as smart as our cars are, they can still be quite vulnerable to thieves and other malicious actors.
Source(s)
