What happened?
On 25 September 2024, researchers Karan Saini and Sam Curry published findings that Kia dealerships’ web infrastructure allowed registering account-level control over vehicles the registrant did not own – using only a license plate number. The window from research to fix was unusually fast: Kia patched the flaw on 23 August; public disclosure followed a month later with video proof. When this post publishes on 27 September 2024, the demonstration is a working replay of the summer’s defining genre: the car as a remotely operable endpoint, and the dealer API as its unguarded admin console.
Quick Answer: Security researchers found that Kia’s dealer-facing dealer portal and associated APIs – the machinery behind the Kia Connect app – contained an access-control flaw: given only a vehicle’s license plate (obtainable from any parking lot or street photo), an attacker could register a MyKia account linked to that VIN, then remotely lock, unlock, start, stop, track location, and honk the vehicle via the app’s API endpoints. The flaw affected model years 2014-2025 with the connected-car hardware enrolled. The core defects: dealer-portal registration flows that did not verify ownership, and API endpoints that trusted a VIN-scoped bearer token without binding it to an actual owner relationship. Kia patched in the US on 23 August 2024, before disclosure. No exploitation in the wild was demonstrated, and other markets were fixed in roll-out stages.
Execution took about 30 seconds from license plate to remote command capability. The researchers chained three soft spots: a dealer-portal registration endpoint that accepted a VIN without proof of ownership; an API base that issued tokens scoped to that VIN after a simple email confirmation; and remote-command endpoints (lock, unlock, start, stop, locate, horn) that validated the token but never the relationship between caller and vehicle. The result was functionally identical to owning the car’s digital key, minus the car. The demo video – unlocking and starting a stranger’s Kia in a parking lot – was the year’s most effective display that access-control bugs can be as dangerous as memory-corruption ones.
The paper trail
| Date | Event |
|---|---|
| 2024-06→07 | Researchers develop the plate-to-command chain against US-market vehicles; document the dealer-portal registration and API trust flaws |
| 2024-07-08→14 | Findings reported to Kia via coordinated disclosure; Kia acknowledges and begins engineering a fix |
| 2024-08-23 | Kia deploys the ownership-verification fix across US dealer and consumer portal infrastructure |
| 2024-09-25 | Technical write-up and demo video published; coverage cycles through automotive and security media |
| 2024-09-27 | This post publishes amid follow-ups probing other automakers for sibling flaws; Kia confirms no observed abuse and staged international rollout continues |
Not a stop-sale, but a stop-trust moment
The industry conversation after disclosure centered on a taxonomy problem: this was not a vulnerability in the traditional CVE sense – no memory corruption, no injected payload, no radio protocol attack. It was an authorization defect in a business flow: two systems (dealer registration, remote-command API) that each worked as designed individually, but whose composition made “any plate → any car” a valid transaction. That class of flaw is invisible to scanners and pen-tests that model attackers as malicious traffic rather than legitimate customers of the wrong object. It is also exactly the class that multiplies as cars become software platforms: every automaker now runs some version of dealer portal + owner app + vehicle API, and each seam where those systems meet ownership data is a place the composition can lie.
What the attacker actually gets
The capability inventory matters for threat-modeling. Remote unlock: access to contents, and in unattended contexts, to the cabin. Remote start: on keyless models with remote-start subscriptions, engine start while unattended – a theft enabler when combined with key-fob relay or the vehicle already in an accessory state. Location: stalk a vehicle’s movements, which for a stalking victim is the most dangerous capability of the set and the one privacy lawyers zeroed in on. Horn/lights: harassment at distance. What the attacker does not get: steering, braking, or driving control – those sit behind different, better-guarded controller gates. The honest severity verdict: high for privacy and property, physical-harm risk concentrated in the tracking capability rather than the driving systems.
How the fix works
Kia’s August remediation folded three changes into one deployment: the dealer-portal registration flow now requires verified proof of ownership before a VIN can be linked to an account; the token-issuing API validates the owner relationship server-side at issuance rather than trusting the dealer layer’s say-so; and remote-command endpoints re-check the relationship per request, so a stale or forged token scoped to a VIN is no longer sufficient. That last layer – verify at the point of effect, not the point of entry – is the pattern every composed authorization system converges on after an incident of this shape. Defense in depth for identity data is not paranoia; it is the acknowledgment that any single seam will eventually be misconfigured.
- Ownership must be a server-side check: any flow that turns an identifier (plate, VIN) into account control needs verified proof of ownership at the boundary, not email confirmation.
- Composition bugs beat scanning: two individually-correct systems composed into an authorization hole – threat-model the seams, not just the components.
- Location is the crown capability: remote lock and start make headlines; live tracking is what endangers people.
- Coordinate fast when the fix is business logic: Kia’s August patch shows vendor-side fixes for access-control flaws can ship in weeks, not quarters.
FAQ
Which vehicles were affected?
US-market Kia models from 2014 to 2025 equipped with the connected-car enrollment hardware – the population eligible for Kia Connect or the successor app features. The flaw sat in the web/API layer, not the vehicle, so any enrolled model with remote services active was in scope. Kia stated the fix was deployed across US infrastructure in August and extended to other regions afterward in phases.
Was anyone actually attacked?
No public evidence of in-the-wild abuse exists. The researchers demonstrated under controlled conditions with their own and consented vehicles; disclosure was coordinated and the fix preceded publication by a month. That pattern – fix first, publish after – is the disclosure ecosystem working as designed, and it is why the story reads as a warning rather than an incident.
Can the same flaw exist in other brands?
Almost certainly siblings exist somewhere: the researchers noted parallel research streams against other automakers’ portals that year, and the underlying pattern (dealer systems with weak ownership binding feeding consumer app APIs) is an industry architecture, not a Kia invention. Automakers that added ownership checks only at the app layer – trusting the dealer layer to have verified – carry the same composition risk until audited. Expect the genre to recur; connected-car APIs are young, and authorization is the youngest part of them.
Legacy: the plate is the password
The Kia findings joined a lineage – the 2015 Jeep hack, the blazer-in-the-driveway remote-start frauds, the constellations of API-borne telematics flaws – but with a sharper moral: the attack surface has moved decisively from the vehicle’s radios to the vendor’s web stack. A plate printed on the bumper is a public identifier; treating it as secret input to an ownership flow is a design decision that no threat model survives. By late 2024, the automotive-security conversation had consolidated around API authorization as the front line, and the humble license plate – the oldest public identifier on the road – had its permanent place in the canon as the credential nobody thought they were handing out.
