[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRytZivfZAYupvpTOp97bhe1JnxVrDZExGWObp47I_5A":3},{"article":4,"iocs":48,"watch_terms":62,"solutions":63,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"439902e2-0447-4656-a1ec-544db2598d60","Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns","researchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns-455923","Pair of researchers chain WAF bypasses and default logins to command vehicles in Australia and the US","Security researchers discovered vulnerabilities in the Android apps of two major automakers, allowing them to remotely control vehicle functions like unlocking doors, starting engines, and sounding horns. The exploits leveraged weaknesses in the ForgeRock identity platform, including WAF bypasses and default credentials, to gain unauthorized access and issue commands.","Researchers exploited flaws in automakers' Android apps to remotely unlock cars and honk horns.","https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F11\u002F09\u002Fresearchers-pwn-automakers-android-apps-to-remotely-unlock-cars-honk-horns\u002F5308483","https:\u002F\u002Fimage.theregister.com\u002F?imageId=5306530&width=800","2026-11-09T17:31:00+00:00","2026-11-09T18:00:01.942444+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"ForgeRock OpenIDM","product",{"name":21,"type":19},"Apache Felix",{"name":23,"type":24},"Android Apps","technology",{"name":26,"type":24},"WAF",{"name":28,"type":29},"Assetnote","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,56,59],{"type":50,"value":51,"context":52},"mitre_attack","T1071.001","Web Protocols (HTTP\u002FHTTPS) used in WAF bypass",{"type":50,"value":54,"context":55},"T1552.001","Default password exploitation in ForgeRock OpenIDM and Apache Felix",{"type":50,"value":57,"context":58},"T1059.005","Scripting: MicroPython\u002FGroovy used for shell access",{"type":50,"value":60,"context":61},"T1078.004","Cloud Accounts: Compromise of cloud-based identity accounts",[28,18,21],{"controls":64,"vendors":152},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":95,"name":96,"problem":97,"products":98},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":124,"name":125,"problem":126,"products":127},"waf-ddos","Web application firewall and DDoS protection","Websites and APIs stay up, and common web attacks are filtered before they reach them.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"f5","F5","\u002Fvendor-logos\u002Ff5.png","web-app-and-api-protection","F5 Web App and API Protection","https:\u002F\u002Fwww.f5.com\u002Fsolutions\u002Fweb-app-and-api-protection","Web application firewall, API security, bot management and DDoS mitigation, as a service or self-managed.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","app-and-api-protector","Akamai App & API Protector","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fapp-and-api-protector","Web application firewall, bot and DDoS protection for websites and APIs.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png","imperva-cloud-waf","Imperva Cloud WAF","https:\u002F\u002Fwww.imperva.com\u002Fproducts\u002Fweb-application-firewall-waf\u002F","Cloud web application firewall with DDoS and bot protection.",[],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"default-credentials-and-waf-bypasses-let-researchers-remotely-hijack-connected-cars","Default Credentials and WAF Bypasses Let Researchers Remotely Hijack Connected Cars","Researchers exploited weaknesses in the ForgeRock identity platform used by major automakers, including WAF bypasses and default credentials left in production environments, to gain unauthorized remote control over vehicle functions such as door locks and engine starts. The root failure was twofold: identity infrastructure was misconfigured with default credentials never rotated, and perimeter defenses (WAF) were bypassable, meaning no meaningful barrier stood between attackers and sensitive vehicle control APIs. This matters enormously because connected vehicle APIs bridge the digital and physical worlds — a compromised app is not just a data breach, it is a potential physical safety incident. Organizations deploying third-party identity platforms must treat their configuration hardening and credential hygiene with the same rigor as their own code.",[158,159,160,161,162,163,164],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 7: Continuous Vulnerability Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"CIS Control 17: Incident Response Management":168,"OWASP A06:2021 Vulnerable and Outdated Components":169,"CIS Control 7: Continuous Vulnerability Management":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"NIS2 requires incident handling and security measures for networked systems; automakers operating connected vehicle infrastructure are obligated under this article to ensure access control and configuration management practices prevent exactly this type of unauthorized remote command execution.","The WAF bypass and default credential issues represent known flaw classes; a formal flaw remediation process would have required these to be identified and corrected before the system was exposed to production traffic.","The ability to remotely unlock and start vehicles constitutes a physical safety incident class; a tested incident response plan specific to connected vehicle API compromise would reduce response time and limit harm when such exploits are discovered.","The automakers relied on a third-party identity platform (ForgeRock) without sufficiently hardening or validating its configuration, mirroring the OWASP risk of using components without reviewing their security posture.","Regular vulnerability scanning of the ForgeRock deployment and associated WAF configurations would have identified the exploitable weaknesses before researchers — or malicious actors — did.","This control requires organizations to identify, assess, and remediate technical vulnerabilities in a timely manner; applying it to the ForgeRock platform would have prompted hardening of default settings and WAF rules.","Default credentials left active on the ForgeRock identity platform directly violated the requirement to manage identities and enforce strong authentication for access to sensitive resources, including vehicle control APIs."]