The Indian Computer Emergency Response Team (CERT-In) has identified multiple security vulnerabilities in select versions of Tata Motors' iRA 2.0 and iRA.ev connected vehicle applications. According to CERT-In's vulnerability advisory issued on November 4, the vulnerabilities could allow attackers to extract sensitive credentials, access vehicle-related information and services, impersonate users and modify application data without authorisation. The agency has assigned a 'High' severity rating to these vulnerabilities, urging users to promptly update to the latest versions to protect sensitive information. The warning flags a risk of unauthorised access and modification of data with the privileges of the impersonated user.
The vulnerabilities affect specific versions of both applications. As reported by CERT-In, the affected versions are Tata Motors iRA 2.0 version 26.7.3 and earlier, and iRA.ev version 26.7.2 and earlier. The agency has advised users of the affected applications to upgrade to iRA 2.0 version 26.8.2 and iRA.ev version 26.9.1 to address the identified vulnerabilities. An email sent to Tata Motors Passenger Vehicles remained unanswered regarding the security advisory.
CERT-In has identified four vulnerabilities involving credential storage, validation of web content, handling of authentication tokens and security of communications between applications and backend services. According to the vulnerability assessment, the first vulnerability involves hardcoded credentials in the applications, attributed to the presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could download the application package and extract this information to gain access to associated backend services and perform unauthorised operations on the car. The second vulnerability concerns inadequate validation of URLs and origins loaded through the applications' WebView component, identified as insufficient validation of URLs and origins loaded within the WebView component.
The third vulnerability involves authentication tokens being recorded in application logs used for development and debugging, which could be accessed and misused to gain access to user accounts. The fourth vulnerability relates to improper implementation of SSL certificate pinning in the applications' network security configuration, which could potentially allow attackers to intercept or modify data exchanged between the application and its backend services. According to CERT-In's assessment, these applications cater to customers of its internal combustion engine (ICE) and electric vehicles, respectively, providing access to connected vehicle services including remote vehicle commands, vehicle status, health monitoring and trip information.
According to CERT-In's assessment, Tata Motors' iRA 2.0 and iRA.ev applications provide customers with access to connected vehicle features such as vehicle status, health monitoring, trip information and remote commands. The applications, which come with the cars, turn one's smartphone into a remote control and monitoring hub for the car, allowing users to track location, check vehicle health and fuel/battery status, and control features like door locks or cabin climate from anywhere. CERT-In warns that successful exploitation could allow attackers to access and modify data using the privileges of an impersonated user, highlighting the critical nature of these security weaknesses. These vulnerabilities come at a time when connected devices have been extremely susceptible to hacking, leading to real-world damage as seen in recent incidents where supermarket fridges were hacked in Europe and their temperatures were arbitrarily increased.
