A security researcher bought a 2021 Hyundai Ioniq SEL. The typical challenge would be to run Doom on the In-Vehicle Infotainment (IVI) system. In a really good article he does include dead ends and issues on his journey. At the end of which he achieved root access on the IVI.
After the initial research phase he identified the IVI software D-Audio2V. The updates were distributed as password-protected ZIP archives. ZIP archives are vulnerable to a known-plaintext attack that can be executed with bkcrack. After some digging and debugging bkcrack was able to find the key. Further down the line he discovered that the password was present in the repo all along. It was listed in a shell script. The script also included an AES encryption key. A quick search revealed that it was the AES 128bit CBC example key listed in the NIST document SP800-38A. The RSA public key for signing was not in the script, but he extracted it from the updater binary in the firmware. A quick search revealed that it was taken directly from the tutorial RSA Encryption & Decryption Example with OpenSSL in C. As The Register reports, that tutorial also contains the matching private key, so he could sign his own firmware updates, and Hyundai did not respond to a request for comment.