Three Million Vehicles Vulnerable After Security Flaw Found in Car Alarms

Three Million Vehicles Vulnerable After Security Flaw Found in Car Alarms

Vulnerabilities found in two different car alarms left three million vehicles susceptible to hijack globally.

Security researchers have found that two popular car alarms have fixed security vulnerabilities that allowed them to remotely track, hijack and take control of vehicles with the alarms installed.

The systems, built by Russian alarm maker Pandora and California-based Viper (or Clifford in the U.K.), were vulnerable to an easily manipulated server-side API, according to researchers at Pen Test Partners, a U.K. cybersecurity company.

Their findings showed that the API could be abused to take control of an alarms system's user account and the vehicle itself. The vulnerable alarms could be tricked into resetting an account password because the API was failing to check if it was an authorized request, allowing the researchers to log in. 

The researchers also found they could listen in on the in-car microphone, built-in as part of the Pandora system for making calls to the emergency services or roadside assistance.

Although the researchers bought alarms to test, they said "anyone" could create a user account to access any genuine account or extract all the companies' user data.

According to Pen Test Partners, some three million cars globally were vulnerable to these flaws, which have since been fixed.

About the Author

Sydny Shepard is the Executive Editor of Campus Security & Life Safety.

Featured

New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises.