General Motors and Shanghai OnStar (SOS) iOS Client

Risk Summary

ATTENTION: Remotely exploitable/low skill level to exploit.

CVEs (3)

Remediations

• Users should not root or jailbreak their phones to prevent the preconditions for attacker access to mobile phone memory, including the ability to read JSON web token encryption keys.
• GM HTTP Public Key Pinning rollout is complete to mitigate Man-In-The-Middle attacks for SOS iOS Client Version 7.1. The rollout includes back office and iOS client changes (now version 7.2). For North America iOS OnStar clients, HTTP Public KeyPinning deployment (back office and mobile app) is scheduled for December 2017.
• Debugging code was removed from SOS Identity Management servers to prevent attacker access to user accounts.

Affected Vendors

Affected Products (1)