Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns

Researchers exploited weaknesses in the ForgeRock identity platform used by major automakers, including WAF bypasses and default credentials left in production environments, to gain unauthorized remote control over vehicle functions such as door locks and engine starts. The root failure was twofold: identity infrastructure was misconfigured with default credentials never rotated, and perimeter defenses (WAF) were bypassable, meaning no meaningful barrier stood between attackers and sensitive vehicle control APIs. This matters enormously because connected vehicle APIs bridge the digital and physical worlds — a compromised app is not just a data breach, it is a potential physical safety incident. Organizations deploying third-party identity platforms must treat their configuration hardening and credential hygiene with the same rigor as their own code.