A Default Password Let Researchers Unlock, Start and Track Two Automakers’ Cars

A Firewall, a Parsing Trick and admin:admin

Both carmakers’ Android apps log customers in through ForgeRock, an identity platform that Thoma Bravo combined with Ping Identity in 2023. The apps led the researchers to the part that stores the customer records, ForgeRock Identity Management (IDM).

Its administrative pages sat behind a web application firewall, which blocked the requests and, after repeated tries, the researchers’ IP address. They got around it with path confusion. The firewall and the server behind it read the same web address differently, so a request that looked like a harmless static file to the firewall reached something else on the server: the Apache Felix web console, a management page built into IDM.

That console has its own login, separate from IDM’s. By default the username and the password are both “admin”, and Ping’s hardening guide tells customers to remove the console or change those credentials before going into production. On both automakers’ servers, “the default credentials worked,” the researchers write.

From the console they set up a scheduled job that ran their own code. That gave them a command line on the production identity servers, where the server’s environment also held the IDM administrator’s username and password.

From an Admin Account to Someone's Driveway

With the administrator account, they could search the customer directories by name, email address or phone number and change any customer’s email and password.

To prove it, they took a test account, changed its email to an inbox they controlled and set a new password. Then they signed in through the normal app flow. The six-digit verification code went to their inbox, not to the owner’s. The account’s garage listed the vehicles with their VINs, models and subscriptions, plus the same remote commands the owner’s app offers: location and telemetry, locking and unlocking, engine start and stop. Shah unlocked and started the test car with its owner standing beside it, then stopped the engine and locked it again.

The real owner would have had little chance to notice. Changing the email and password “did not invalidate the account owner’s existing app session”, so the owner stayed logged in. And because the app accepted a device ID and push token supplied by the phone, an attacker could have registered their own device for the account’s notifications.

The affected systems served customers in several regions. The researchers tested the full chain only with US accounts and cars, and they give no number of affected customers.

What It Means If You Drive a Connected Car

There is nothing for you to patch. The flaw sat on the automakers’ servers, and they closed it months ago. The write-up does not say whether the companies checked their logs for anyone who found the same door earlier.

Keeping the brands secret was the automakers’ wish, and Curry went along with it. He writes that he does not want them diverting resources because they are worried about the disclosure. It is a friendly gesture toward the companies. For owners, it means they cannot know whether their car was one of them.

It is not the first time. In November 2024 the same pair found that Subaru’s Starlink admin panel let them start, unlock and locate cars and pull a year of location history, knowing only an owner’s last name and ZIP code, email address, phone number or license plate. Subaru fixed it within a day.

In both cases the weak point was the carmaker’s web server, not the car. A connected car is, in practice, also an account on someone else’s server, and whoever controls the server can do what the app does. If you never use the remote features, ask the automaker or your dealer whether connected services can be switched off for your car. A function that is off can’t be triggered from a hacked server.

Ping’s guide deals with the Felix console in a few lines. Both automakers fixed it in two hours, which is fast. Reading those lines before launch would have been faster.