White hat hacker finds WiFi flaws in mobile app for popular auto; Mitsubishi working on fix.
It all started a few months ago when a friend of penetration tester and self-styled industry maverick Ken Munro bought a Mitsubishi Outlander.
Munro, who works for U.K.-based penetration testers Pen Test Partners, says a red flag went off for him when he looked over the plug in hybrid electric vehicle (PHEV) and found that the mobile application communicates via WiFi.
“With other high-end cars like BMWs or Mercedes Benz’s the mobile app communicates over GSM or, in the U.S., LTE 4G,” he says. “GSM and LTE are broadly much harder to hack than WiFi.”
Not long after he first saw the Outlander, Munro went out and bought a new Outlander and ran a man in the middle attack over the WiFi communications. Sure enough, he was able to hack in and disable the anti-theft alarm.
“I know this can be upsetting but keep in mind that this field didn’t exist three years ago,” Munro explains. “So to be fair to the car companies, they are working to fix the various flaws we find.”
Munro spoke with Dark Reading this week, sharing some behind-the-scenes information on the Outlander hack and tips for what people who bought the cars can do to protect themselves until Mitsubishi issues a fix, which Munro says the carmaker intends to do.
The following slides give you an idea of how Munro exposed the vulnerability in the Outlander:
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024