A previouisly patched flaw found in a mobile app that accompanies Hyundai cars was disclosed on Tuesday, more than a month after it was addressed by the car manufacturer.
Security researchers William Hatzer and Arjun Kumar first discovered the vulnerability in the MyHyundai with Blue Link mobile app, according to a full report by CSO Online.
By leveraging the vulnerability, an attacker could access sensitive information such as the car owner’s username, password, PIN, in addition to GPS data tied to the car’s location history.
Available for models released after 2012, the application allows for drivers to remotely locate their cars, unlock doors if their keys are lost or stolen, and start or stop their engine remotely if the car is parked and locked.
Hatzer and Kumar worked with security firm Rapid7 to coordinate the disclosure of the vulnerability.
