Hackers needed just the VIN to take over a Kia’s cameras and start it remotely
Researchers discovered an alarming vulnerability in a Kia web portal that allowed them to track, view the camera feeds, and remotely unlock and even start the engines of millions of Kia vehicles.
Wired reports that Kia has fixed the bug, but it follows a troubling series of security lapses that could have dangerous real world consequences to safety and privacy.
The flaw was in Kia’s web portal that gave the researchers the same extensive powers as a car dealer, via a lack of authentication in the site’s API. Dozens of models of Kia vehicles were vulnerable to the bug, which only required a car’s VIN identifier to access the controls.
The flaw was in Kia’s web portal that gave the researchers the same extensive powers as a car dealer, via a lack of authentication in the site’s API. Dozens of models of Kia vehicles were vulnerable to the bug, which only required a car’s VIN identifier to access the controls.
