Default Passwords on ForgeRock Servers Allow Hackers to Control Connected Cars

Security researchers Shubham Shah and Sam Curry have uncovered a critical vulnerability affecting the backend systems of two major automakers' mobile applications. The flaw, stemming from the use of default 'admin:admin' credentials on ForgeRock identity platform servers, allowed them to gain complete control over customer accounts. This access extended to the ability to unlock doors and start the engines of connected vehicles, posing a significant risk to vehicle owners.

The attack targeted the ForgeRock identity platform, which was used by both automakers for customer authentication. Specifically, the researchers found an administrator console for the OpenIDM component, responsible for managing customer records, that retained its default password. ForgeRock's own security guidelines recommend removing this console or securing it before deployment, as it stores its password separately from the main system.

While the console was not directly accessible from the public internet, the researchers employed a technique involving encoded slashes and extra characters to trick the network edge into treating the request as a static file, while the backend server interpreted it as a path to the administrator console. Once inside, they utilized a built-in scheduler to execute code on the identity server, gaining a command prompt on the machine housing customer data.

From this privileged position, the researchers were able to modify account details, including email addresses and passwords, for target accounts. They then used these altered credentials to log into the normal mobile application as the customer. The compromised accounts provided them with access tokens that are normally used by the legitimate application, granting them control over the vehicle's functions.

The researchers demonstrated the severity of the exploit by unlocking, starting, and then re-locking a test vehicle with the owner's explicit consent. They emphasized that their full attack chain was tested only on U.S. accounts and vehicles. A separate attack targeting Australian systems revealed that administrative credentials were left embedded within the app's code, intended for testing purposes, which also allowed for similar vehicle control capabilities in Australia, the United States, and Canada.

The attack was stealthy, as changing the email and password did not automatically log the owner out of their app. Furthermore, the researchers could redirect account alerts to their own devices, preventing the owner from being notified of the compromise. After their tests, the researchers restored the original email addresses, and it remains unknown if any malicious actors discovered or exploited this vulnerability before it was patched.

This incident highlights a common security pitfall: misconfiguration of identity management systems. The vulnerability was not in the ForgeRock software itself, but in how it was deployed and managed by the automakers. There is no specific CVE associated with this flaw, as it stems from a failure to follow vendor hardening best practices. Security teams managing similar identity platforms are advised to verify the removal or proper securing of the Apache Felix console and to avoid relying solely on edge or Web Application Firewall (WAF) rules for protecting administrative interfaces.

The researchers, who have a history of uncovering vulnerabilities in automotive and connected car systems, noted that this incident is part of a broader trend of weak web security across the automotive industry. Their previous work has exposed similar account takeover risks in connected car services from Honda, Kia, and Subaru, underscoring the persistent need for robust security measures in vehicle software.