Millions of Kia Vehicles Open to Remote Hacks via License Plate

The vulnerability is the latest discovered in connected vehicles in recent years, and it points out the cyber dangers lurking in automotive APIs.

Car buyers typically have many questions when purchasing a new automobile, but few are likely to consider whether an attacker could remotely control their vehicle using just license plate information.
Yet thats exactly what millions of Kia vehicles allowed until mid-August, when the automaker fixed a flaw that enabled such access, after independent security researchers alerted them to the issue.
The glitch is similar to those that the same group of researchers and others have discovered in recent years, and is sure to stoke already high concerns over the
vulnerability of modern connected vehicles
to cyberattacks.
In a Sept. 26 report
, independent researcher Sam Curry said he discovered the Kia vulnerability when doing some follow-up research on
multiple flaws he and colleagues discovered a couple of years ago
in vehicles from Kia, Honda, Infiniti, Nissan, Acura, BMW, Mercedes, and others.
At the time, the researchers showed how anyone could take advantage of the vulnerabilities to issue commands for remotely locking and unlocking vehicles, starting and shutting down the engine, and activating a vehicles headlight and horn. Some of the flaws allowed an adversary to remotely take over an owners account and lock them out of managing their own vehicle, while others enabled remote access to a vehicles camera, with the ability to view live images from inside the vehicle. Some of the hacks required an adversary to have little more than a vehicle identification number, and sometimes even just an owners email address.
As with many of the previous flaws, the new issue that Curry and his fellow researchers discovered had to do with the application programming interface (API) protocols that enable Internet-to-vehicle commands on Kia automobiles.
The researchers found that it was relatively easy to register a Kia dealer account and authenticate it to the account. They could then use the generated access token to call APIs reserved for use by dealers, for things like vehicle and account lookup, owner enrollment, and several other functions.
After some poking around, the researchers found that they could use their access to the dealer APIs to enter a vehicles license-plate information and retrieve data that essentially allowed them to control key vehicle functions. These included functions like turning the ignition on and off, remotely locking and unlocking vehicles, activating its headlights and horn, and determining its exact geolocation.
In addition, they were able to retrieve the owners personally identifying information (PII) and quietly register themselves as the primary account holder. That meant they had control of functions normally available only the owner. The issues affected a range of Kia model years, from 2024 and 2025 all the way back to 2013. With the older vehicles, the researchers developed a proof-of-concept tool that showed how anyone could enter a Kias vehicle license plate info and in a matter of 30 seconds execute remote commands on the vehicle.
The recent discovery underscores the intricate challenges posed by the complex API protocols — such as gRPC, MQTT, and REST — used in connected cars, says Ivan Novikov, CEO of API security firm Wallarm. Automakers must prioritize enhancing their cybersecurity measures by implementing stronger authentication methods and securing communication channels to protect against unauthorized access.
Akhil Mittal, senior manager of cybersecurity strategy and solutions at Synopsys Software Integrity Group, says the new discovery highlights how the biggest vulnerabilities in connected vehicles often have to do with systems that communicate with the outside world. He points to always-connected
vehicle telematics systems
as one example of such a component.
Infotainment systems are another concern, as they connect to smartphones, apps, and other services, creating more entry points for hackers into the cars internal network, Mittal says. The recent Kia hack really highlights how APIs and cloud services can be weak spots; if the APIs that control critical functions arent secured properly, they become easy targets for attackers.
News of the Kia hack adds to growing concerns over connected vehicles — and not just about their security either. Earlier this year, two senior US lawmakers
slammed General Motors, Honda, and Hyundai
for collecting extensive data from connected vehicle about owners and their movement. The two lawmakers, Sens. Ron Wyden (D-Ore.) and Edward Markey (D-Mass.) called the data collection by the three automakers of a symptomatic industry-wide problem that highlighted the need for greater oversight and scrutiny of automaker practices.
Automotive vendors have proven irresponsible at security again and again, and I wonder how much more we are going to see before action is taken, says David Brumley, CEO of software security firm ForAllSecure. Yesterday the average driver worried about [the theft of their] key fob. Today, they have to worry about whether their dealer or manufacturer has an unprotected API. Where is the [National Transportation Safety Board] on this?
Kia Motors did not respond immediately to a Dark Reading request for comment.

Last News
▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security	▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Millions of Kia Vehicles Open to Remote Hacks via License Plate