CVE-2017-12697

A Man-in-the-Middle issue was discovered in General Motors GM and Shanghai OnStar SOS SOS iOS Client 7.1. Successful exploitation of this vulnerability may allow an attacker to intercept sensitive information when the client connects to the server...

CVE-2017-12697

CVE-2017-12697 affects General Motors and Shanghai OnStar SOS iOS Client version 7.1. The connected documents describe a Man-in-the-Middle vulnerability where the client may transmit or validate data in a way that enables an attacker to intercept sensitive information when the client connects to ...

SSL Certificate Not Validated Vulnerability in OnStar IOS Client

OnStar iOS client is a smart driving system. An SSL certificate not verified vulnerability exists in AnjiStar IOS client. Since the AngelStar IOS client uses SSL HTTPS communication with the server, the security processing method is to do the verification of the server certificate before the...

Arbitrary Account Password Reset Vulnerability in OnStar iOS Client Server

OnStar iOS client is a smart driving system. An arbitrary account password reset vulnerability exists in the OnStar iOS client server. An attacker can reset the password of any client and perform unauthorized operations by intercepting the verification code in a packet...

Encryption Key Plaintext Storage Vulnerability in OnStar IOS Client Communication

OnStar iOS client is a smart driving system. There is an encryption key plaintext storage vulnerability in the communication of AnjiStar IOS client. As the communication between the OnStar IOS client and the server uses SSL encryption protocol, the OnStar IOS client fails to do any processing of...

General Motors and Shanghai OnStar (SOS) iOS Client

CVSS v3 9.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: General Motors GM, Shanghai OnStar SOS Equipment: SOS iOS Client Vulnerabilities: Cleartext Storage of Sensitive Information, Man-in-the-Middle, Improper Authentication REPOSTED INFORMATION This advisory was originall...

Court Documents Reveal How Feds Spied On Connected Cars For 15 Years

It's not always necessary to break into your computer or smartphone to spy on you. Today all are day-to-day devices are becoming more connected to networks than ever to add convenience and ease to daily activities. But here's what we forget: These connected devices can be turned against us becaus...

OwnStar Device Can Remotely Locate, Unlock, and Start GM Cars

Car hacking just jumped up a few levels. A security researcher has built a small device that can intercept the traffic from the OnStar RemoteLink mobile app and give him persistent access to a user’s vehicle to locate, unlock, and start it. The device is called OwnStar and it’s the creation of Sa...

Blowback: Microsoft, OnStar Pump the Brakes on Location Tracking

Redmond, Washington software giant, Microsoft, and Detroit based GM subsidiary, OnStar backtracked on policies widely seen as egregious privacy violations following lawsuits and public outcry. Here’s the news: Windows Phone Update Requires User Consent For Tracking Microsoft released their “Mango...

OnStar to Track Speed, Location of Cars, Even After Users Opt Out

Cars with OnStar’s built-in technology will begin having their where-abouts monitored in December, even if their owners opt-out of the service, according to a new privacy statement issued by the vehicle navigation and emergency notification service this week. The document, available here in .PDF...