Subaru Car Vulnerability Lets Hackers Control Millions of Cars Remotely Using Starlink

A critical vulnerability in Subaru’s STARLINK connected vehicle service was discovered late last year, exposing millions of vehicles and customer accounts across the United States, Canada, and Japan to potential cyberattacks.

Subaru is known for its all-wheel-drive vehicles, high safety ratings, and strong presence in motorsports. Popular models like the Outback and Forester contribute to its top 10 U.S. sales ranking.

The security vulnerability allowed attackers to remotely access sensitive vehicle and personal data with minimal information such as a last name and ZIP code, email address, phone number, or license plate. Exploiting the flaw would have enabled malicious actors to:

• Remotely start, stop, lock, and unlock vehicles.
• Access real-time vehicle locations and retrieve detailed location histories from the past year.
• Extract customers’ personally identifiable information (PII), including addresses, billing details (partial credit card information), emergency contacts, and vehicle PINs.
• Query additional user data such as support call history, odometer readings, sales records, and more.

The researchers demonstrated the vulnerability by successfully taking over vehicles using only license plate numbers. They also retrieved over a year’s worth of precise location data from a test vehicle. This data included thousands of GPS coordinates updated with every engine start.

How the Vulnerability Was Found

The researchers initially examined Subaru’s MySubaru mobile app but found it well-secured. Shifting focus to employee-facing systems, they discovered an administrative portal for STARLINK services through subdomain scanning.

At first, the site didn’t seem to have much—just a login panel, and there weren’t any credentials available. However, while researching the website’s source code, this stood out:

<script type="text/javascript" src="/assets/_js/starlinkEnroll.js"></script>

This pointed to some interesting JavaScript files in the /assets/_js/ folder. To dig deeper, a brute-force of the directory was conducted to uncover any hidden files.

After a few minutes using FFuF, a file named login.js was discovered, containing the following code:

$('#new_password_submit').on('click', function(e) {
 e.preventDefault();
 if($('#forgot-password-step4-form').valid()) {
  disableBtns();
  $.ajax({
            url: "/forgotPassword/resetPassword.json",
   type: "POST",
            contentType: "application/json",
            data: JSON.stringify({
                email: email,
                password: $('#new_password').val(),
                passwordConfirmation: $('#confirm_new_password').val()
            }),
   async: false
  }).done(function (response) {

The code suggested that the /forgotPassword/resetPassword.json endpoint could reset employee accounts without requiring a confirmation token!

If this was accurate, an attacker could exploit this by using any valid employee email to take over their account. To verify this, a POST request was sent to check if the functionality was exposed and operational.

The portal contained a password reset endpoint that allowed account takeovers without requiring confirmation tokens. Using publicly available information from LinkedIn and other sources, they identified valid employee email addresses to exploit this flaw.

Once inside the admin system, they bypassed two-factor authentication (2FA) by disabling client-side security overlays. This granted them unrestricted access to STARLINK’s backend functionality, including:

• Viewing and exporting detailed location histories for any connected Subaru vehicle.
• Searching for customer accounts using basic identifiers like ZIP codes or VINs.
• Adding unauthorized users to vehicles without notifying owners.

The researchers tested their access on a friend’s car with permission to validate their findings further. They successfully unlocked the vehicle remotely without triggering any alerts or notifications.

The flaw was identified by cybersecurity researchers Shubham Shah and a colleague, who reported the issue to Subaru on November 20, 2024. The automaker acted swiftly, patching the vulnerability within 24 hours of the report.

Subaru responded promptly after receiving the researchers’ report. The vulnerability was fixed within hours on November 21, 2024. According to the researchers, there is no evidence that the flaw was exploited maliciously before being patched.

This incident highlights broader concerns about cybersecurity in connected vehicles. Modern cars collect vast amounts of data and rely on interconnected systems that are difficult to secure comprehensively.

The researchers noted that employees often have broad access to sensitive information as part of their routine tasks, making such systems inherently vulnerable.

The findings serve as a stark reminder of the importance of robust security measures in protecting consumer data and ensuring trust in connected technologies.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free