Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.
replyWhy would they be so circumspect? Presumably the automaker has fixed this by now.
On the non-Australian side (the Sam Curry blog)
reply After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.
It probably wouldn't be JLR. They're having to be the insurer of last resort in their home country because some of the high-end Land Rovers are so trivial to steal they're otherwise near effectively uninsurable. https://www.autocar.co.uk/car-news/new-cars/range-rover-thef...
replyThat article says the big problem was with "old architecture" so it is possible that somebody brave at JLR actually persuaded the Powers That Be that they should invest an hour's time and $10 to do a halfway good job at this and beat the poor state of the art.
replyOften when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was much worse
Defamation/legal risk, even if such legal actions will be spurious
replydeleted
reply