Sam Curry started a group chat  and all began to work with the goal of finding vulnerabilities affecting the automotive industry. Over the next few months, they found as many car-related vulnerabilities as they could. The following write-up details their work exploring the security of telematic systems, automotive APIs, and the infrastructure that supports them.

Tracking system
One of the biggest discoveries was that if the Spireon tracking system (which is present in many cars) is hacked, it will be able to send arbitrary commands to an estimated 15.5 million vehicles. From unlocking to even starting the engine. He could also obtain any location of the cars and in some cases, he could take over an entire fleet himself. So did police vehicles and ambulances, which poses a huge danger. (Dutch Newspaper AD - Autoredactie/HLN 04-01-23, 05:00)

​

BMW, Mercedes, Ferrari, and Kia have the worst security
At brands such as Mercedes, BMW, and Ferrari, Curry said he was able to view and edit large parts of the accounts of both owners and employees of the companies. For brands such as Kia, Honda, Nissan, and Hyundai, the hacking went even further. With these cars, he could hack the cars to unlock the cars, start the engine, stop the engine, locate the vehicle, turn on the headlights, and much more. Specifically for Kias, he could even remotely access the 360-degree camera and view live images of the car. (Dutch Newspaper AD - Autoredactie/HLN 04-01-23, 05:00)

​

Read more about Sam's investigations at https://samcurry.net/

​

More Automotive Information Security information you can find on the page of the UNECE Taskforce; Cyber Security and (OTA) software updates (CS/OTA)