Cybersecurity Experts Warn of Privacy Risks in Modern Automobiles

Hackers revealed serious vulnerabilities in Subaru’s Starlink infotainment system, enabling remote vehicle control and access to sensitive location data

Agencies Ghacks
Jan 27, 2025
Security
|
3

A pair of hackers, Sam Curry and Shubham Shah, have exposed alarming security vulnerabilities within Subaru’s Starlink-connected infotainment system, enabling them to remotely take control of a Subaru Impreza. The duo gained unauthorized access to the vehicle through a compromised web portal linked to Subaru that allowed them to unlock the car, sound the horn, and start the ignition using any smartphone or computer.

Curry elaborated on their methods in a video and blog post, revealing that he simply reset the password of a Subaru employee’s account, thereby accessing a repository of location data that dated back over a year. The hackers noted that this data included precise records of the vehicle’s movements, down to specific parking spots. Subaru acknowledged the breach and stated that it has since patched the vulnerability, emphasizing its need to collect location data to assist in emergencies and vehicle recovery.

However, Curry and experts in the hacking community argue that automotive manufacturers have little justification for collecting extensive historical location data. They warn that the vulnerabilities they exploited are not exclusive to Subaru, claiming similar flaws exist in the systems of brands like Acura, Honda, Hyundai, Toyota, and more.

Meanwhile, cybersecurity concerns aren’t limited to Subaru. Security researchers from Kaspersky recently identified 13 critical vulnerabilities within Mercedes-Benz’s MBUX infotainment system, capable of allowing hackers to steal data and disable anti-theft protections if they can access the vehicle physically. Although Mercedes-Benz responded that it had patched these vulnerabilities since 2022, concerns remain about the security risks posed by modern connected vehicles.

The growing consensus among cybersecurity experts is clear: modern automobiles pose significant privacy and security threats. A recent Mozilla report emphasized that many cars are “a privacy nightmare,” collecting excessive data without informed consent from users and raising alarms about the potential for hackers to exploit these vehicles.

Advertisement

Previous Post: «
Next Post: «

Comments

  1. John C. said on January 28, 2025 at 1:18 pm
    Reply

    Oh Brave New World with cars like these….

  2. boris said on January 28, 2025 at 1:13 am
    Reply

    More dangerous is that every infotainment system send data directly to data brokers and car insurance companies. My advice for people: if possible, do not buy new cars and find mechanic that can disable GPS/Internet connection for infotainment system.

  3. pHROZEN gHOST said on January 27, 2025 at 6:20 pm
    Reply

    TV fiction becomes reality.

Leave a Reply

Check the box to consent to your data being stored in line with the guidelines set out in our privacy policy

We love comments and welcome thoughtful and civilized discussion. Rudeness and personal attacks will not be tolerated. Please stay on-topic.
Please note that your comment may not appear immediately after you post it.