Shubham Shah, co-founder at Assetnote, and researcher Sam Curry worked together on the exploits earlier this year. By tinkering with the cars’ Android apps, they devised exploit paths to issue remote commands to vehicles in Australia and the US.
The pair published separate blogs covering different aspects of the research; Shah said the US attack "required a lot more work" because the automaker "spent much more time securing the US, Canadian, and European OpenIDM environments." Both exploit chains centered around weaknesses in the ForgeRock identity platform relied upon by both automakers, the identities of which were kept anonymous by the researchers, who have previously highlighted flaws in the likes of Hyundai, Kia, Subaru, and many others.
