MyCar Controls uses hard-coded credentials

Vulnerability

The MyCar Controls mobile application (iOS versions prior to 3.4.24, Android versions prior to 4.1.2) contains hard-coded admin credentials (CWE-798) that can be used to authenticate to the server endpoint for any user's account [4]. The app is used to control aftermarket telematics units that provide remote start, lock/unlock, and GPS location features [1][2][3].

Exploitation

A remote unauthenticated attacker can use the hard-coded credentials to send commands to and retrieve data from a target MyCar unit without needing the user's actual username and password [4]. The attacker only needs network access to the server endpoint; no user interaction is required.

Impact

Successful exploitation allows the attacker to learn the vehicle's location via GPS, and to send commands such as remote start, lock/unlock, and other functions [4]. This could lead to unauthorized physical access to the vehicle and potential theft or surveillance.

Mitigation

AutoMobility released updated mobile apps that remove the hard-coded credentials: iOS version 3.4.24 and Android version 4.1.2 [4]. Additionally, the admin credentials in old versions have been revoked. Users should update their apps. The fix also applies to rebranded versions: Carlink, Link, Visions MyCar, and MyCar Kia [4].