- And how does it work?
— Using the identified vulnerability, anyone can gain access to the remote account of an authorized vehicle owner. Flaws in the user interface on the support servers allow the user's email address to be replaced with any other address without authorization and a password reset operation can be performed, followed by sending the password to the attacker's address. This turned out to be so easy to do that our researchers called their report "Gone in 6 Seconds."
— What exactly can attackers do?
— After receiving the user password and logging into the account on the smartphone, you can launch the application, which allows you to track the movement of the car on the map, remotely turn off the engine for forced stopping and open the doors, as well as listen to and record conversations in the cabin using the microphone provided by the alarm system for communication with emergency services and technical assistance.
- Wait, so we can use this right now?
- Certainly.
- Undoubtedly.
— There's a drug cartel car on Route 66 right now , equipped with this alarm. Can we get it under control?
- Yes, sure!
- Johann, this is very important to us. They are israel whatsapp data shedding their tail. Order your people to do this.
- Rita, can you?
- No problem, boss! What exactly needs to be done?
— First, listen to what they are talking about.
- Easy. Listen.
Half an hour passed.
- Rita, can you block the engine and doors of their car? At least for 10 minutes? Until the operatives arrive.
- Of course. However, please note that in two days we will inform the manufacturers about the vulnerability.