Kaspersky Lab researchers have examined the security of 13 car-sharing applications, developed by major manufacturers from different markets which - according to Google Play statistics - have been downloaded over one million times.
Whilst car sharing apps are invaluable for those on a low income and remove any overpayment of vehicle ownership or maintenance, they can also add a security risk for manufacturers and users alike.
The company’s experts discovered that all of the applications contain a number of security issues that can potentially allow criminals to take control of shared vehicles, either by stealth or under the guise of another user. This could lead to criminals carrying out illegal and dangerous moves on the roads under the guise of other people’s identities.
Upon successful exploitation, an attacker can discreetly gain control of the car and use it for malicious purposes – from riding for free and spying on users, through to stealing the vehicle and its details, and even more serious scenarios like stealing users’ personal data and selling it on the black market for financial gain.
What were the findings?
The research discovered that each of the examined apps contained several security issues. Moreover, the researchers found that malicious users are already capitalising on stolen accounts for car sharing applications.
The list of security vulnerabilities uncovered includes:
No defence against man-in-the-middle attacks. This means that while a user believes he is connected to a legitimate website, the traffic is actually being re-directed through the attacker’s site, allowing him to gather any personal data entered by the victim (login, password, pin, etc.)
No defence against application reverse engineering. As a result, a criminal can understand how the app works and find a vulnerability that would allow him to obtain access to server-side infrastructure
No rooting detection techniques. Root rights provide a malicious user with almost endless capabilities and leave the app defenceless
Lack of protection against app overlaying techniques. This helps malicious apps to show phishing windows and steal users’ credentials Less than half of applications demand strong passwords from users, meaning criminals can attack the victim through a simple brute force scenario.
“Our research concluded that, in their current state, applications for car sharing services are not ready to withstand malware attacks. And while we have not yet detected any cases of sophisticated attacks against car sharing services, cybercriminals understand the value that such apps hold, and existing offers on the black-market point to the fact that vendors do not have much time to remove the vulnerabilities,” said Victor Chebyshev, security expert at Kaspersky Lab.
The company advises users of car-sharing apps to follow these measures in order to protect their cars and private data from possible cyberattacks:
Don’t root your Android device, as this will open almost unlimited capabilities to malicious apps
Keep the OS version of your device up to date, to reduce vulnerabilities in the software and lower the risk of attack
Install a proven security solution, in order to protect your device from cyberattacks.
LEGAL DISCLAIMER: This Message Board accepts no liability of legal consequences that arise from the Message Boards (e.g. defamation, slander, or other such crimes). All posted messages are the sole property of their respective authors. The maintainer does retain the right to remove any message posts for whatever reasons. People that post messages to this forum are not to libel/slander nor in any other way depict a company, entity, individual(s), or service in a false light; should they do so, the legal consequences are theirs alone. Bizcommunity.com will disclose authors' IP addresses to authorities if compelled to do so by a court of law.