On June 11, 2024, a significant security vulnerability was disclosed in Kia vehicles as exploitable remotely these vulnerabilities allowed an attacker to gain unauthorized control over key vehicle functions using only the license plate.
The attack could be executed rapidly, in approximately 30 seconds, regardless of the vehicle’s Kia Connect subscription status.
Beyond vehicle control, the vulnerabilities also enabled attackers to silently access sensitive personal information, including the victim’s name, contact details, and physical address, which could then be used to add an unauthorized second user to the victim’s vehicle without their knowledge.
Researchers discovered a flaw in Kia’s owner portal that allowed unauthorized access to vehicles, where an attacker could send a GET request to owners.kia.com with crafted parameters to exploit a vulnerability and obtain a session token (Sid).
This token, along with the vehicle’s unique identifier (Vinkey), could then be used in a second GET request to the Kia API (api.owners.kia.com) to remotely unlock the car door, which prompted the researchers to investigate the Kia dealer website, suspecting similar weaknesses.
Researchers investigated Kia’s new vehicle activation process and found a URL used for initial registration containing a dealer-generated access token and vehicle identification number (VIN).
The token was validated against a Kia Connect dealer endpoint using a POST request. Analyzing dealership JavaScript revealed potential employee-only API calls like dealer vehicle lookup using the “/dec/dlr/dvl” endpoint.
With their own dealer token, they attempted a similar POST request to this endpoint using a known VIN, aiming to access internal dealer functionalities.
They found that the dealer API access token provided to car owners wasn’t working. By analyzing the communication between the owner’s app and Kia’s server, they were able to replicate the registration process for a dealer account.
It allowed them to generate a valid dealer access token using a fake dealer registration. With this token, they could query Kia’s backend and retrieve sensitive owner information like name, phone number, and email address.
By exploiting a series of APIs, attackers could gain a dealer token, retrieve the victim’s information using a VIN, demote the owner’s access with leaked email, and add themselves as the primary account.
According to Samcurry, it enabled remote commands such as lock/unlock, start/stop, honk, and locate to be executed on Kia vehicles manufactured after the year 2013.
A proof-of-concept dashboard was built to demonstrate the attack by taking license plate as input, retrieving VIN, performing the takeover steps, and displaying a list of compromised vehicles for further control.