I think automaker failed security the moment its cars connected to the internet
[dead]
GM was doing this 25 years ago.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
They had other issues. SQLI, XSS and XSRF were rampant in those days.
I've pondered how "secure" the old OnStar system was. It was apparently just some level of in-band signalling/modem communication on top of AMPS (or CDMA).
I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.