Subaru security vulnerability exposed millions of cars to tracking risks

Security researchers Sam Curry and Shubham Shah discovered a major vulnerability in Subaru's Starlink connected vehicles, allowing unrestricted access to all vehicles and customer accounts in the U.S., Canada, and Japan. After notifying Subaru in November, the company quickly addressed the issue. The vulnerability could have enabled hackers with limited information to perform actions like remotely unlocking vehicles and accessing sensitive data. Despite acknowledging the fixes, Curry and Shah emphasized the ongoing privacy risks in the automotive industry, including the potential misuse of location data by employees.

"You can retrieve at least a year's worth of location history for the car, where it's pinged precisely, sometimes multiple times a day."

Read at Fast Company