Incident(s) of the Week: Disgruntled Hacker Disables 100 Cars Purchased from Texas Auto Center

In late February and early March, around 100 cars in and around Austin, Texas either would not start or would not stop honking.  This was apparently caused by 20 year old hacker, Omar Ramos-Lopez, who remotely triggered the vehicle immobilization system installed by dealership Texas Auto Center.

Apparently the dealership installed the GPS-enabled devices so that cars can be immobilized and repossessed when a customer fails to make scheduled payments. The web-based system developed by Pay Technologies apparently lets auto dealerships trigger the horn and disable the car’s ignition system from the relative safety of the Internet.  (Something you may want to be aware of if you are financing a car these days.)

Ramos-Lopez was laid off from Texas Auto Center in February (Wired reports this event as a “workforce reduction”) and apparently retained a username and password to the dealership account.  Weeks later, he used the credentials from home to access the account and trigger the immobilization devices.  His reign of terror, which included changing customer names to “Tupac,” was apparently somewhat modest.  While he had access to all 1,100 cars in the system, the 100 cars affected were the result of Ramos-Lopez going through the customer database in alphabetical order.  Austin’s High Tech Crime Unit arrested Ramos-Lopez on Wednesday after police traced the IP address he used to his home.

Leave a Reply

Your email address will not be published. Required fields are marked *