SiriusXM Vulnerability Lets Hackers Remotely Unlock and Start Connected Cars

Dec 05, 2022Ravie LakshmananVehicle Security / Internet of Things

Cybersecurity researchers have discovered a security
vulnerability that exposes cars from Honda, Nissan, Infiniti, and
Acura to remote attacks through a connected vehicle service
provided by SiriusXM.

The issue could be exploited to unlock, start, locate, and honk
any car in an unauthorized manner just by knowing the vehicle’s
vehicle identification number (VIN), researcher Sam Curry said in a
Twitter thread^[1]
last week.

SiriusXM’s Connected Vehicles (CV) Services are said^[2] to be used by more than
10 million vehicles in North America, including Acura, BMW, Honda,
Hyundai, Infiniti, Jaguar, Land Rover, Lexus, Nissan, Subaru, and
Toyota.

The system is designed^[3]
to enable a wide range of safety, security, and convenience
services such as automatic crash notification, enhanced roadside
assistance, remote door unlock, remote engine start, stolen vehicle
recovery assistance, turn-by-turn navigation, and integration with
smart home devices, among others.

The vulnerability relates to an authorization flaw in a
telematics program that made it possible to retrieve a victim’s
personal details as well as execute commands on the vehicles by
sending a specially crafted HTTP request containing the VIN number
to a SiriusXM endpoint (“telematics.net”).

In a related development, Curry also detailed^[4]
a separate vulnerability affecting Hyundai and Genesis cars that
could be abused to remotely control the locks, engines, headlights,
and trunks of the vehicles made after 2012 by using the registered
email addresses.

Through reverse engineering the MyHyundai and MyGenesis apps and
inspecting the API traffic, the researchers found a way to get
around the email validation step and seize control of a target
car’s functions remotely.

“By adding a CRLF character^[5]
at the end of an already existing victim email address during
registration, we could create an account which bypassed the JWT and
email parameter comparison check,” Curry explained.

SiriuxXM and Hyundai have since rolled out patches to address
the flaws.

The findings come as Sandia National Laboratories summarized^[6]
a number of known flaws^[7]
in the infrastructure powering electric vehicle (EV) charging,
which could be exploited to skim credit card data, alter pricing,
and even hijack an entire EV charger network.