Zero Day Vunerability in BMW connected drive portal? - Bimmerfest - BMW Forums



Go Back   Bimmerfest - BMW Forums > BMW Model Discussions > 3 Series & 4 Series > F30 / F31 / F32 / F33 / F34 / F36 (2012 - current)

F30 / F31 / F32 / F33 / F34 / F36 (2012 - current)
The sixth generation BMW 3 Series Sedan F30/F31/F34 and the first first generation 4 Series Coupe F32/F33/F36. Get the latest 3 and 4 series pricing from our ordering and pricing guide sticky thread.

Reply
 
Thread Tools Display Modes
  #1  
Old 07-08-2016, 06:24 AM
jjrandorin jjrandorin is offline
Officially Welcomed to the 'Fest
Location: San Diego
 
Join Date: May 2013
Posts: 8,827
Mein Auto: 18' Tesla Model 3 Perf.
Zero Day Vunerability in BMW connected drive portal?

”cDrive issue”

Saw yesterday that there is a hack vulnerability in BMW connected drive portal. Received an email this morning from BMW stating that "I will need to re register with my bmw in september".

Quote:
According to researchers from Vulnerability Labs, there are two main bugs both related to the BMW online service web app for ConnectedDrive, the connected car hub for new, internet-connected vehicles produced by the automaker.
Quote:
The first flaw, found in the ConnectedDrive portal, is a VIN session vulnerability. The VIN, or vehicle identification number, is used to identify individual models connected to the service.
Quote:
The second bug is a cross-site scripting vulnerability the researchers discovered client-side on the BMW web domain in the password reset token system. The researchers call the problem a "classic" cross-site scripting vulnerability, as the security flaw does not need privileged user accounts to be exploited;
Anyone concerned?

http://www.zdnet.com/article/hackers...ed-car-portal/
Attached Thumbnails
Click image for larger version

Name:	Connected1.jpg
Views:	1690
Size:	127.4 KB
ID:	570105  
__________________

2019 X3 M40i Phytonic Blue |Blk Leather W/Blue Stiching | Alu. Rhombicle trim | Adaptive Suspension | Premium Pack | Drivers Assist | Drivers Assist + | Wireless Charging | 21" 718 Wheels| | Executive Pack | HK Stereo (hers)

18' Tesla Model 3 Performance |blue /blk|Perf. pack|FSD

BMW CCA #477341

Last edited by [email protected]; 07-11-2016 at 10:29 AM.
Reply With Quote
Sponsored Links
Advertisement
 
  #2  
Old 07-08-2016, 08:29 AM
Weaselboy's Avatar
Weaselboy Weaselboy is offline
Officially Welcomed to the 'Fest
Location: California
 
Join Date: Jul 2002
Posts: 2,035
Mein Auto: 2018 BMW 540i
I have an account on there and received no such email notification. The article does sound like there is legitimate reason to be concerned.
Reply With Quote
Reply

See More Related BMW Stories


Forum Navigation
Go Back   Bimmerfest - BMW Forums > BMW Model Discussions > 3 Series & 4 Series > F30 / F31 / F32 / F33 / F34 / F36 (2012 - current)
Today's Posts Search
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On



Forum Jump


All times are GMT -7. The time now is 10:23 AM.


Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2020 DragonByte Technologies Ltd.
© 2001- VerticalScope Inc. All rights reserved.