Passwords to Access over a Half Million Car Tracking Devices Leaked Online

Megalith

Megalith

24-bit/48kHz
Staff member
Joined
Aug 20, 2006
Messages
13,000
The Kromtech Security Center has found over half a million records belonging to SVR, a company that specializes in vehicle tracking, publicly available online: everywhere a car has been in the past 120 days is accessible for those who have the right login credentials for SVR’s app, which is downloadable for desktops, laptops, and almost any mobile device.

Researchers discovered a misconfigured Amazon AWS S3 bucket that was left publicly available. The breach has exposed information about their customers and re-seller network and also the physical device that is attached to the cars. The repository contained over a half of a million records with logins / passwords, emails, VIN (vehicle identification number), IMEI numbers of GPS devices and other data that is collected on their devices, customers and auto dealerships. Interestingly, exposed database also contained information where exactly in the car the tracking unit was hidden.
 
And so somebody can just go in and disable every single one of these vehicles remotely.

If I was the hacker, that is what I would probably do.

And then the lawsuits would start rolling in and these companies that don't keep their crap secure might learn their lesson.
 
So SVR are sending out new SIMs to all their customers, right? So SVR are resetting all passwords, right?

Do I hear crickets?
 
cyclone3d said:
And so somebody can just go in and disable every single one of these vehicles remotely.

If I was the hacker, that is what I would probably do.

And then the lawsuits would start rolling in and these companies that don't keep their crap secure might learn their lesson.
Click to expand...


Only smucks that bought cars that allow that kind of nonsense..... Can't do much with the lojack on my car but watch me go to/from work...

But god damn, another leak from a misconfigured S3 bucket.... No wonder our company is going crazy with our s3 audit the last couple weeks.
 
I keep these stories handy when people ask why I drive old cars. Not to mention piles of money saved from buying decent used vehicles.

Ok. Sounding like a fogey but still..
 
So, the conclusion is that we should all totally and completely trust the IoT? I mean who would ever even think of hacking your home? :rolleyes:
 
You must log in or register to reply here.
Back
Top