Your Kia Is About To Get Stolen

A group of independent security researchers recently revealed a ridiculous vulnerability in Kia’s web portal that could allow hackers to remotely control the connected features of millions of Kia vehicles, including unlocking doors, tracking locations, and even starting the ignition.

This flaw is the second of its kind found in Kia’s systems in the past two years. It highlights a worrying trend in web-based car security, affecting not just Kia, but every other automaker who has decided to go down this path—namely, everyone.

The vulnerability reportedly allowed researchers to reassign control of a car’s features to their own custom app simply by knowing the vehicle’s license plate or VIN. After Kia was notified in June, the automaker implemented a temporary fix but hasn’t provided a permanent solution or commented further.

The larger issue here is how automakers secure — or don’t secure — the web infrastructure that connects modern vehicles. While embedded vehicle systems receive a lot of attention, web-based security often falls by the wayside, leaving open pathways for cyberattacks that are relatively easy to exploit compared to traditional car hacks.

With car companies rolling out more connected features to keep pace with consumer demand, this issue is likely to persist. Unless automakers put serious focus on web security, researchers warn that these kinds of remote hijacking vulnerabilities will continue to surface across the industry.

As for me, I'm sticking with my 20-year-old Panther platform which still requires a physical key to turn the ignition tumbler.

Become an AutoGuide insider. Get the latest from the automotive world first by subscribing to our newsletter  here.