HACKING MY CAR, AND PROBABLY YOURS - SECURITY FLAWS IN VOLKSWAGEN'S APP

Summary from the TLDR InfoSec newsletter

After a security researcher purchased a new Volkswagen and found that they were locked out of connecting to the app, they decided to attempt to brute-force the app and discovered further vulnerabilities after succeeding. The researcher discovered that the app leaked credentials for other services, such as Salesforce and the owner's personal details and vehicle service history, which could be accessed with only a VIN. The researcher coordinated with Volkswagen, and as of May 6, they were able to verify the fix.