Default 'admin:admin' Server Password Helped Researchers Hack Two Automakers

Two security researchers found they could take over the login systems behind two car brands' mobile apps by using a default administrator password on ForgeRock identity servers. The access could reach any customer account, and in tests on their own and consenting owners' cars in the United States it allowed them to unlock doors and start engines. Both systems were fixed about two hours after the researchers reported the problem.

How the default password opened the console

Both brands signed customers in through ForgeRock, an identity platform now part of Ping Identity. That platform runs in two parts: one for login and one, called OpenIDM, that holds customer records. OpenIDM includes a built-in administrator console powered by Apache Felix. On these servers, the console remained and still used the documented default, with admin as both username and password. Although it was blocked from the open internet, the edge guarding the site and the Java software behind it read the same web address differently. By adding encoded slashes and extra characters, the researchers made the edge treat the request as a harmless static file while the server treated it as the path to the console. Inside the console, a built-in scheduler ran small scripts that executed their own code on the identity server, giving them a command prompt on the machine holding customer records for both brands' logins.

From account access to vehicle commands

The researchers changed a target account's email address and password, signed in as that customer through the normal app, and received the same access tokens the real app uses. Using the account's own vehicle commands, they unlocked the doors and started the engine of a test car while the owner stood next to it, then stopped the engine and locked it again. They said they could open a session for any customer account on the affected servers, but ran vehicle commands only on cars they owned or were allowed to use, and tested the complete chain only with US accounts and vehicles. Changing the email and password did not log the owner out of the app, and the researchers could direct the account's alerts to their own phone. They put the real email address back after the test. Neither write-up says whether anyone else found or used the path before it was closed.

A separate path in Australia

Shubham Shah published a second attack on the Australian systems behind the same brands. There, the way in was different: admin credentials for the identity server had been left in the app's code, intended for a test setup. He set out the full Australia chain in a separate post. With both attacks together, the researchers said they could send unlock and engine-start commands to the brands' cars in Australia, the United States, and Canada. That second post does not give a date for when the Australian systems were fixed.

What identity teams should check

The brands' mistake was in how they ran ForgeRock, not a new bug in the product, so there is no CVE and no vendor advisory to follow. The console and its default password have been documented for years, and the maker's production hardening guide already tells operators to remove the console or change its password before going live. For teams running the same identity software, now sold as PingIDM, two checks matter: look for the Apache Felix console at /system/console and remove it or change its default password, and do not count on edge or WAF path rules to hide an admin page. The two researchers have a long record of this kind of work. They have shown remote access to vehicles from Honda, Kia, and Subaru, among others, and a broader 16-brand study in 2023 found the same kind of web weakness across much of the industry.

Sources: The Hacker News