Default 'admin:admin' Server Password Helps Researchers Hack Two Automakers, Unlock and Start Cars

Security researchers discovered a vulnerability in the login systems of two car brands' mobile apps, which allowed them to gain complete control over the systems. The researchers found that they could access any customer's account and, for accounts with connected cars, unlock the doors and start the engine. The vulnerability was related to the use of ForgeRock, an identity platform, on the servers, which had a default password that was not changed. This default password was used by the researchers to gain access to the systems. The researchers were able to exploit this vulnerability to take control of the login systems and access customer accounts. The vulnerability highlights a security risk in the connected car systems of the two affected car brands.