admin:admin on identity servers: cars unlocked and started

Two security researchers have demonstrated that the login systems of the mobile apps of two car brands could be completely taken over. The finding, published by The Hacker News, allowed access to any customer's account and, in the case of an owner with a connected car, unlocking the doors and starting the engine. Both apps authenticated users through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers found an access with default credentials.

The specific detail that has come to light is that the affected servers had admin:admin configured as the username and password. In other words, the classic administration access left unchanged. With that entry point, attackers could reach the identity platform and, from there, manipulate the apps' authentication. The result: taking control of other people's accounts and, in connected vehicles, executing physical actions such as opening the car or starting the engine.

The news does not detail how many vehicles or customers were exposed, nor whether the manufacturers have already fixed the problem. It also does not specify whether there was real exploitation beyond the researchers' proof of concept. What is clear is the pattern: a weak credential in a central identity service opens the door to damage that goes far beyond data loss.

Why this matters to an SMB (even if it doesn't make cars)

The case is striking because of the sector, but the underlying mistake is common in any company. Identity servers —ForgeRock, Keycloak, Active Directory, Okta or any other— are the heart of authentication. If an attacker controls them, they can issue valid sessions, impersonate users or modify access policies. And if those servers also keep default credentials, the effort to get in is minimal.

In an SMB, the equivalent could be a WordPress administration panel with admin/admin, a router with the factory password or a database server with the root user without a password. The lesson is the same: default credentials are an open door, and in connected environments the consequences can be physical.

This incident fits the trend we have been observing on the blog: authentication flaws that allow bypassing the login. We recently discussed the case of OpenSSH and that of Barracuda, where two chained vulnerabilities gave root access without authentication. The difference here is that the vector is not a software flaw, but a misconfiguration: the famous admin:admin.

What we recommend from ForgeNEX

You don't have to be a car manufacturer to take note. Any SMB with services exposed to the Internet should review these points:

• Inventory of default credentials. Review routers, switches, application servers, administration panels and cloud services. Change any username and password that comes from the factory.
• Strong and unique passwords. No admin/admin, root/root or 1234. Use a password manager and require two-factor authentication (2FA) for administrative access.
• Principle of least privilege. Identity servers should not have an administrator account accessible from the Internet without additional protections. Segment the network and limit access to trusted IP addresses.
• Monitoring of anomalous access. Log and alert on logins from unexpected locations or at unusual times, especially on privileged accounts.
• Review of suppliers and dependencies. If you use a third-party identity platform, check that its default configuration does not leave known credentials. Ask your supplier about their hardening practices.
• Periodic penetration tests. An external test can detect precisely this type of oversight before an attacker does.

In addition, the case underlines the importance of security in the software lifecycle. Mobile apps that connect to identity services must validate that the backend does not expose weak configurations. Protecting the app is not enough; the authentication server is the critical link.

The context: identity as a target

Attackers have long been focusing on identity providers. A single flaw in these platforms can compromise all of a company's customers. In the case of connected cars, the impact transcends personal information: the physical world can be acted upon. For an SMB, the equivalent would be an attacker being able to issue invoices in its name, access its ERP or modify orders.

The news does not clarify whether the affected manufacturers have issued a patch or whether the researchers followed a responsible disclosure process. What we do know is that the vector was a default credential on a ForgeRock server. That should raise a flag in any IT team: check today whether any service in your infrastructure still has the factory username and password.

At ForgeNEX we work with SMBs that often inherit infrastructures with legacy configurations. If you need a quick review of credentials and access, or want to implement a password and 2FA policy, we can help you. Security does not start at the firewall, but in not leaving the door open with the key in the lock.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.