11/5/2022
Researchers have discovered a security vulnerability in SiriusXM services that allows remote hacking of connected cars from Honda, Nissan, Infiniti and Acura.
The issue could be exploited to unlock, start, locate, and honk any car in an unauthorized manner just by knowing the vehicle’s vehicle identification number (VIN), researcher Sam Curry said in a Twitter thread last week.
SiriusXM’s Connected Vehicles (CV) Services are said to be used by more than 10 million vehicles in North America, including Acura, BMW, Honda, Hyundai, Infiniti, Jaguar, Land Rover, Lexus, Nissan, Subaru, and Toyota.
The system is designed to enable a wide range of safety, security, and convenience services such as automatic crash notification, enhanced roadside assistance, remote door unlock, remote engine start, stolen vehicle recovery assistance, turn-by-turn navigation, and integration with smart home devices, among others.
The vulnerability relates to an authorization flaw in a telematics program that made it possible to retrieve a victim’s personal details as well as execute commands on the vehicles by sending a specially crafted HTTP request containing the VIN number to a SiriusXM endpoint (“telematics.net”).
Full Link ( Hacker News ) Here
© CopyRights RawNews1st
