This Bug Makes Honda, Nissan, Infiniti, and Acura Cars Hijackable

Latest research finds that an infotainment system flaw lets hackers hijack Honda, Acura, Nissan, and Infiniti cars.

As you know, these big automotive brands have equipped their vehicles with state-of-the-art technology to make driving more convenient. While sophistication is great, it can sometimes backfire.

If you own one of the aforementioned machines with the latest infotainment system, you have the right to worry every time you leave your car alone, because if a cunning hacker happens to walk around your parking lot, they could track, unlock, and start your vehicle without you knowing.

For more craziness, the hacker could also honk the horn, flash the lights, open the trunk, and steal your data including name, address, phone number, and car details.

All of these things can be done due to a bug in SiriusXM telematics program, which lets hackers gain unauthorized control over your vehicle by sending forged HTTP requests to it using only your VIN number.

The security flaw was discovered by a group of researchers during its problem hunting in cars from well-known marques. Sam Curry, one of the researchers, was trying to identify potential vehicle issues linked to telematic service providers that partner with car companies.

It’s no secret that a lot of modern cars have the ability to transfer and receive data via the internet. This process called telematics is designed to enhance customizability and convenience as it allows drivers to control their cars remotely.

However, hackers could take advantage of the technology to streamline their crimes. They could launch cyberattacks and remotely take control of a car.

More car hacking!

Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.

Here’s how we found it, and how it works: pic.twitter.com/ul3A4sT47k

— Sam Curry (@samwcyo) November 30, 2022

Curry and his friends have attempted to break into different car systems through driving apps and found a grave security leak in Sirius XM’s infrastructure, which comes standard with most automakers.

The feature grants easy access to vehicle functionalities and facilitates communication with the SiriusXM API through the web. By exploiting its authentication loophole, hackers could infiltrate the platform to send commands to the vehicle or extract personal data from it.

Curry and his team have notified SiriusXM about the problem. The radio giant responded quickly by fixing it right away. Does this end the privacy threat, though? Not necessarily, because we still have another big issue on our hands.

In case you don’t realize, telematics itself actually involves serious privacy risks, since car companies have a tendency to monetize vehicle data. They may contract with spy firms that sell customer information to government departments.

In the end, we know that technological advances don’t always mean a good thing. It’s probably safer to drive an old junker than a high-tech electric car these days.

If you’re commuting in a 1963 Chevrolet Corvette, you always know that nobody is attempting to control your car remotely, since the old machine doesn’t have a computer system to hack into.

Via: Gizmodo