Cybersecurity researchers have revealed a series of vulnerabilities in Kia vehicles that, if exploited, could have enabled remote control of key vehicle functions using only a license plate.
These vulnerabilities affected nearly all Kia models made after 2013, potentially exposing sensitive information such as the owner’s name, phone number, email address, and physical address. Worse, attackers could covertly add themselves as secondary users to a vehicle, giving them control without the owner's knowledge.
According to security researchers Neiko Rivera, Sam Curry, Justin Rhinehart, and Ian Carroll, the exploit involved Kia’s dealership infrastructure, specifically through the endpoint "kiaconnect.kdealer[.]com." By registering a fake account and generating an access token via an HTTP request, attackers could access the vehicle identification number (VIN), gain the owner’s contact details, and ultimately gain control over the vehicle.
How the Attack Worked
The process was shockingly simple, requiring only four HTTP requests to achieve full control over the vehicle. Here’s the general attack flow:
- Generate a dealer token through a Kia dealership API using a license plate or VIN.
- Fetch the victim's email and phone number through the same API.
- Modify the owner's access and add the attacker as a primary account holder.
- Gain control of the vehicle remotely using the attacker’s email address, allowing them to issue commands like unlocking doors, starting the car, or honking the horn.
Perhaps most concerning, victims were not notified when their vehicle was accessed or their account details were altered.
The researchers outlined a potential scenario where an attacker could input a Kia vehicle’s license plate, extract the owner's information, and execute commands on the vehicle—all within 30 seconds.
Kia’s Response
After responsible disclosure in June 2024, Kia patched the vulnerabilities by August 14, 2024. Fortunately, there is no evidence that these flaws were exploited in real-world attacks. However, the incident highlights the ongoing security challenges facing connected cars.
"Cars will continue to have vulnerabilities," the researchers noted. "In the same way that social platforms like Meta can introduce vulnerabilities, car manufacturers could do the same for vehicles."
