Researchers pwn automakers’ Android apps to remotely unlock cars, honk horns
Security researchers exploited flaws in Android apps to gain remote access to connected cars from two major automakers, allowing them to start engines, flash headlights, and sound horns.
- In the Australian version of the app, the researchers first found a vehicle identification number (VIN) using public licence plate checkers, and used those in queries to internal APIs, which provided personal information and owner email addresses.
- According to Curry’s disclosure timeline, he and Shah approached the affected automakers in "early 2026," and the exploits were patched within two hours of receiving the report.
- Issuing commands on the US version also required bypassing WAF filtering through a path traversal, though with a more involved technique: exploiting path confusion to reach the Apache Felix admin console.
By tinkering with the cars’ Android apps, they devised exploit paths to issue remote commands to vehicles in Australia and the US.
Although the automakers wished to remain anonymous, it didn’t take long for some petrolheads to speculate that the partially blurred car in Shah’s demo video was a Toyota, citing the shape of the wing mirror and the unlock sound it made.
- He said: "Obviously, they have asked not to be named, and while normally we would fight to actually include the company names, it's a busy time in the security world and I don't like the idea of them diverting resources because they are worried about something with this disclosure." ®.
- After bypassing the heavy WAF filtering by exploiting path traversal flaws, they were able to invoke the internal admin APIs and take over target accounts using only their email addresses.
- The researchers then queried local admin API endpoints, allowing them to view or modify user account data.
- The researchers used factory default credentials in Felix’s OSGi Web Console to gain admin privileges.
- Onlookers claimed that the two automakers in question were likely Toyota and its luxury brand Lexus.
How this summary was made: extractive summary — built from the sources' own reporting. It is drawn only from the reporting of the sources listed below — read the originals for full detail. How we summarize →