Subaru security vulnerability exposed millions of cars to tracking risks

Two security researchers discovered a security vulnerability in Subaru’s Starlink-connected vehicles last year that gave them “unrestricted targeted access to all vehicles and customer accounts” across the U.S., Canada, and Japan, according to a Wired report.

The researchers, Sam Curry and Shubham Shah, alerted the Japanese automaker to the flaws in November and they were quickly fixed. Subaru told Wired that “after being notified by independent security researchers, [Subaru] discovered a vulnerability in its Starlink service that could potentially allow a third party to access Starlink accounts. The vulnerability was immediately closed and no customer information was ever accessed without authorization.”

The researchers said that a hacker who only knew the car owner’s last name and ZIP code, email address, phone number, or license plate could remotely start, stop, lock, unlock, and retrieve the current vehicle, retrieve any vehicle’s complete location history from the past year, and find personally identifiable information of any customer.

Curry and Shah said that similar web-based flaws have been found in several other carmakers, including Kia, Honda, and Toyota.

While Curry and Shah acknowledged the security fixes, they warned that simply patching security updates after issues were found isn’t enough to remedy the more pervasive issue of privacy in the automotive industry. And even if those vulnerabilities are all remedied, employees still have access to location data.

“You can retrieve at least a year’s worth of location history for the car, where it’s pinged precisely, sometimes multiple times a day,” Curry told Wired. “Whether somebody’s cheating on their wife or getting an abortion or part of some political group, there are a million scenarios where you could weaponize this against someone.”

https://www.fastcompany.com/91266251/subaru-security-vulnerability-exposed-millions-of-cars-to-tracking-risks?partner=rss&utm_source=rss&utm_medium=feed&utm_campaign=rss+fastcompany&utm_content=rss

Létrehozva 6mo | 2025. jan. 23. 21:10:03


Jelentkezéshez jelentkezzen be

EGYÉB POSTS Ebben a csoportban

Tesla sets annual meeting for November amid shareholder pressure

Tesla has scheduled an annual shareholders meeting for November, one day after the

2025. júl. 10. 20:40:02 | Fast company - tech
OpenAI vs. Google could be the heavyweight battle of the half-century

Welcome to AI DecodedFast Company’s weekly newsletter that breaks down the most important news in

2025. júl. 10. 18:20:04 | Fast company - tech
The internet is obsessed with ‘Umamusume: Pretty Derby’

The internet’s latest obsession: training and cheering on anthropomorphized anime horses as they race around a track.

First released in 2021 as a mobile game for iOS and Android, Uma

2025. júl. 10. 15:50:09 | Fast company - tech
These Uber alums are building an army of AI agents for the workforce

Minh Pham and JJ Ford have a knack for riding the waves of new tech.

The duo joined Uber in its early days, helping to spearhead mobile development. When CEO Travis Kalanick was

2025. júl. 10. 15:50:07 | Fast company - tech