In einem Live-Hack zeigte ein Österreicher, wie sich Tesla-Autos über das Smartphone stehlen lassen.

As the 2.6 tonne ute rounds a bend, he gets to work. With the stroke of a key, he kills the headlights, plunging me into darkness. The attack is not a total surprise. The Shark has spent the past two…

Wien 2022. Der Finanzminister der Republik Österreich ist stolz auf sein selbstfahrendes Auto - eines der ersten, das im Lande zugelassen wurde. Doch plötzlich prallt das...

Learn to hack cars using open-source tools and hardware: RAMN from Toyota and more. 🚘👨🏻‍💻🍜🥷🏻☠️ Security researchers and automotive security professionals Tripp Roybal and Tim Krach present a “beginne...

Let's delve into looking at CANBus Bridges, or "Man in the Middle" devices, to see why it might be so a thing worth building to support your CAN powered automotive devices, and we show how to build on...

RAMN (Resistant Automotive Miniature Network), a miniature CAN/CAN-FD testbed of 4 Electronic Control Units. - ToyotaInfoTech/RAMN

https://www.osintinvestigate.com Modern cars are no longer just machines—they're connected computers on wheels. With built-in internet connectivity, Bluetooth, GPS, mobile apps, and over-the-air software updates, today's vehicles offer incredible convenience. But they also introduce new cybersecurity challenges that many drivers never consider. In this episode, we explore the hidden cybersecurity risks facing connected vehicles, how hackers target automotive systems, what security researchers have discovered, and the steps manufacturers are taking to protect drivers. You'll also learn practical ways to keep your vehicle's software secure and why cybersecurity has become an essential part of modern vehicle safety. Whether you own an electric vehicle, a connected SUV, or simply want to understand how technology is transforming transportation, this episode reveals why cybersecurity is becoming as important as seat belts and airbags in the digital age.

Hacking Your Ride: Unpacking Volkswagen's App Flaws & Fortifying Mobility Security In this episode of Upwardly Mobile, we delve into the alarming discovery of significant security flaws in the My Volkswagen mobile app and explore how robust mobile app protection is crucial for the evolving mobility sector. Join us as we dissect the vulnerabilities found and discuss solutions to safeguard connected vehicles and sensitive user data. What We Discussed: • The Volkswagen App Hack Explained: We explore how a security researcher, frustrated by not receiving an OTP for a pre-owned car's My Volkswagen app, discovered critical vulnerabilities12. By brute-forcing a four-digit OTP (One-Time Password), the researcher gained access to the app, which then revealed deeper security issues34. • Serious Vulnerabilities Uncovered: ◦ Internal Credentials Leaked: An API endpoint exposed passwords, tokens, and usernames for various internal services, including payment processing details and CRM tools like Salesforce, in cleartext45. ◦ Owner's Personal Details Exposed via VIN: Simply using a car's VIN (Vehicle Identification Number), an API endpoint revealed extensive customer information from service and maintenance packages. This included names, phone numbers, postal addresses, email addresses, car details (model, colour, registration number, chassis number, engine number), active service contracts, purchase dates, and payment amounts56. ◦ Vehicle Service History Accessible via VIN: The VIN also allowed access to a car's full service history, including details of work performed, customer personal information, and even customer survey results for each workshop visit78. ◦ Additional Data Exposure: Further API endpoints revealed vehicle telematics data, and in some cases, even education qualifications and driving licence numbers, demonstrating a serious scope of customer data exposure9. • The Alarming Impact of These Flaws: These vulnerabilities meant that anyone with just a car's VIN (which is often visible through the windshield) could access real-time vehicle location, engine health, fuel stats, tyre pressure, geo-fencing controls, and all personal details associated with the owner, including home address, phone number, email, and driving licence1011. This poses severe risks from stalkers, criminals, scammers, and hackers who could exploit this data for nefarious purposes, including selling it on the deep web or potentially accessing car systems in the future10. • Volkswagen's Response: The vulnerability was reported to Volkswagen's security team on 23 November 2024, leading to a responsive dialogue and eventual patching of the vulnerabilities by 6 May 2025. • Protecting Mobility Apps with Approov: The incident highlights the critical need for robust mobile app security in the rapidly growing pay-per-use mobility market14. Approov provides solutions that authenticate mobile apps and secure APIs, without impacting customer experience14. • How Approov Secures Mobility Services: ◦ Blocks Data Scraping: Ensures data is accessible only by legitimate mobile apps, blocking tampered apps and scraper bots15. ◦ Prevents Unauthorized Aggregation: Helps retain control of the customer journey by forcing all-in-one services to refer customers to the official app15. ◦ Stops Digital Key Extraction: Blocks malicious attempts to intercept key authorisation during vehicle unlock and start processes, even allowing access without internet connectivity for authentic apps16. ◦ Mitigates Denial or Delay of Service Attacks: Authenticates apps to ensure legitimate API requests come only from the mobile app, dropping malicious traffic before it reaches backend services17. ◦ Secures API Endpoints: Blocks API probing and improper usage by securing communications and locking down mobility APIs to authorized apps only. • BMW Group's Adoption of Approov: We discuss how the BMW Group has successfully integrated Approov into their car sharing platform to balance top-class security with excellent customer experience. This software-only solution provides a patented 'DNA test' to attest that API requests are coming from a genuine mobile app instance running in a safe environment, and has even been enhanced to work over Bluetooth for intermittent internet connectivity. Approov's SDK is already deployed in several thousand BMW Group vehicles. Why This Matters: As the transportation market transforms with shared-use models and connected vehicles, API security becomes even more critical to protect both customer data and vehicle systems. Relevant Links: • Read the full write-up on the Volkswagen security flaws: [Excerpts from "Hacking My Car, and probably yours— Security Flaws in Volkswagen’s App | by LoopSec | May, 2025 | InfoSec Write-ups"] • Learn more about mobile app protection for mobility apps: [Excerpts from "Mobile App Protection for Mobility Apps | Approov"] • Explore the BMW Group's case study with Approov: [Excerpts from "https://approov.io/download/Approov-BMW-Story.pdf"] • Sponsor: Protect your mobile apps and APIs. Visit https://www.google.com/url?sa=E&q=https%3A%2F%2Fapproov.io for more information and to request a demo or free trial! Keywords: mobile app security, car hacking, Volkswagen app, vehicle security, API security, cybersecurity, data privacy, mobility apps, car sharing, Approov, ethical hacking, digital key, automotive security, VIN number, information security, data breaches, connected cars, IoT security.