Attacks/Breaches

4/25/2017
02:28 PM
50%
50%

Hyundai Blue Link Vulnerability Allows Remote Start of Cars

Car maker Hyundai patched a vulnerability in its Blue Link software, which could potentially allow attackers to remotely unlock a vehicle and start it.

A vulnerability discovered in Hyundai Motor's Blue Link app software could potentially allow cyberattackers to gain control of the vehicle, according to security researchers at Rapid7.

Hyundai, the latest car maker to be hit with a vulnerability in its connected car software, has since patched the vulnerability after receiving notice from Rapid7. No known compromises have occurred because of the flaw, Hyundai Motor America and Rapid7 noted in a statement.

The car maker's Blue Link application software version 3.9.4, which was released Dec. 8, and its version 3.9.5 could allow an attacker to exploit the vulnerability over an insecure WiFi connection, or man-in-the-middle attack.

Once exploited, an attacker could capture usernames, passwords, and PINs, then remotely locate the Hyundai vehicle, unlock it, and then start its engine, Rapid7 noted in its report. The car maker is not alone with its connected software problems. In 2015, Fiat Chrysler recalled 1.4 million vehicles that had its UConnect Infotainment systems, after it was discovered attackers could remotely take control of the vehicles' steering and braking.

Read more about Hyundai's Blue Link vulnerability here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Rent A Car
50%
50%
Rent A Car,
User Rank: Apprentice
6/24/2017 | 3:39:30 PM
Re: Car Thief's Dream
I have exactly this car, I'll have to do the updates, I'll see with a pro to handle this
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/26/2017 | 8:35:30 AM
Car Thief's Dream
This is an ideal situation for a car thief; to be able to access the internal mechanisms of the car and drive away with it but not causing any physical damage to the vehicle is unprecedented.
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
How Data Breaches Affect the Enterprise
How Data Breaches Affect the Enterprise
This report, offers new data on the frequency of data breaches, the losses they cause, and the steps that organizations are taking to prevent them in the future. Read the report today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17182
PUBLISHED: 2018-09-19
An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations...
CVE-2018-17144
PUBLISHED: 2018-09-19
Bitcoin Core 0.14.x before 0.14.3, 0.15.x before 0.15.2, and 0.16.x before 0.16.3 and Bitcoin Knots 0.14.x through 0.16.x before 0.16.3 allow a remote denial of service (application crash) exploitable by miners via duplicate input. An attacker can make bitcoind or Bitcoin-Qt crash.
CVE-2017-3912
PUBLISHED: 2018-09-18
Bypassing password security vulnerability in McAfee Application and Change Control (MACC) 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility.
CVE-2018-6690
PUBLISHED: 2018-09-18
Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.
CVE-2018-6693
PUBLISHED: 2018-09-18
An unprivileged user can delete arbitrary files on a Linux system running ENSLTP 10.5.1, 10.5.0, and 10.2.3 Hotfix 1246778 and earlier. By exploiting a time of check to time of use (TOCTOU) race condition during a specific scanning sequence, the unprivileged user is able to perform a privilege escal...