As cars increasingly become enmeshed in the Internet of Things, automakers for the past few years have offered drivers the ability to locate, unlock, and start their car with a smartphone or tablet. From the comfort of your couch, you can crank up the heat in your car or honk its horn with a tap on a touchscreen. But if it’s easy for you to control your vehicle using a mobile app, that also means if you bought it used, whoever owned it before you could still have some kind of access to it. In other words, someone else could still have the ability to locate, unlock, and start your car.
Such was the case with Charles Henderson, a cybersecurity researcher at IBM, who happened to notice a major vulnerability in one automaker’s vehicle connectivity. A few years back, Henderson bought a convertible (the make and model of which he declined to name) and, as an early adopter to technology, was all too happy to connect his smartphone to the vehicle via the automaker’s mobile app. Then he had kids, so he sold the convertible in favor of a more family-friendly vehicle. “Four Years Later, I Still Have Access”
Henderson said he removed all connected devices and wiped his personal information from the outgoing car. He reset the vehicle’s phone book and garage-door opener. The dealership, too, made sure the car was reset and that all keys were turned back in, said Henderson, who is global head of the IBM X-Force Red team of cybersecurity researchers.
H...