Sam Curry and Shubham Shah uncover a series of vulnerabilities in Subaru’s connected vehicle infrastructure, affecting their MySubaru web and mobile platforms. An employee STARLINK admin portal was reachable from the internet, its password reset worked without a confirmation token, and its 2FA prompt lived only in client-side JavaScript. That was enough to remotely locate, unlock, and start vehicles, and to pull a year of location history, using little more than an owner’s last name and ZIP code, email, phone number, or license plate. Subaru responded within hours and fixed the issue the next day, but the findings echo earlier issues found in other car manufacturers’ APIs. A few months earlier, Curry and colleagues showed that Kia vehicles could be remotely controlled in about 30 seconds with nothing but a license plate. Connected car security continues to lag behind, even as automakers double down on app-driven features.
