Curry mentioned the breach into Ferrari’s back-end can also be notable.
“One thing that was kind of fun was the Ferrari vulnerability,” Curry mentioned. “We had everyone who purchased a Ferrari, and we may get their full identify, deal with, telephone quantity, bodily deal with and details about their automobile.
“We could just take over anybody’s Ferrari account and pretend to be them and retrieve their sales documents,” he added.
The group additionally breached Spireon’s back-end. Spireon gives device-independent telematics to fleet automobiles and automobiles working on its OnStar and GoldStar platforms.
“I think people should be worried about Spireon’s vulnerabilities,” Curry mentioned. “They have 15 million completely different automobiles. Spireon has a lot of fleet and end-user automobiles with GoldStar or OnStar and tons of different automobile options.
“We could send commands to cars to disable the starter, to remotely unlock it, remotely start it, and we had full administrative access where we could basically do whatever we wanted with those devices,” he mentioned.
Curry mentioned the Spireon vulnerabilities are regarding as a result of many automobile homeowners, even when they don’t subscribe to OnStar, have the service on their vehicles.
“Spireon is so deeply embedded in the car ecosystem — they have so many different functionalities they provide to so many different customers, millions of users and millions of vehicles,” Curry mentioned. “If we wanted to invite ourselves to the Cincinnati State police, we could have remotely disabled police cars and ambulance starters and stuff like that with this breach.”
Spireon mentioned its cybersecurity professionals evaluated “the purported system vulnerabilities and immediately implemented remedial measures to the extent required. We also took proactive steps to further strengthen the security across our product portfolio as part of our continuing commitment to our customers as a leading provider of aftermarket telematics solutions.”
Curry additionally hacked Reviver, an organization that sells digital license plates to shoppers and fleets. He was capable of acquire full “super administrative access” to handle all Reviver consumer accounts and automobiles.
The capabilities he may carry out remotely included monitoring the bodily GPS location of all Reviver clients. He may replace any automobile standing to “stolen,” which updates the license plate and informs legislation enforcement, and entry all consumer information. The hackers may decide what automobiles individuals owned, their bodily deal with, telephone quantity and electronic mail addresses.
A Reviver spokesperson mentioned firm executives met with Curry and knowledge safety and privateness professionals to repair the corporate’s vulnerabilities.
“Our investigation confirmed that this potential vulnerability has not been misused. Customer information has not been affected, and there is no evidence of ongoing risk related to this report,” Reviver mentioned. “As part of our commitment to data security and privacy, we also used this opportunity to identify and implement additional safeguards to supplement our existing, significant protections.”
Source: www.autonews.com
