Hackers Crack Subaru’s Connected Services To Access Location Data, Door Locks And More

Penetration testers Sam Curry and Shubham Shah found a vulnerability in Subaru’s Starlink administrator console that had been left accessible, enabling compromise of employee accounts and granting admin-level control. With this access, an attacker could view a car’s location history for the past year and use typical Starlink functions like locking, unlocking, and geofencing, posing significant privacy and safety risks to Subaru owners.