Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel

“Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following:”

A last name and ZIP code were enough to take over a Subaru. The employee password reset needed no token, and 2FA ran only in the browser. Curry pulled a year of his mother’s trips, accurate to five meters. Subaru fixed the bug in 24 hours. Its staff still have that access by design.