{
 "schema_version": "0.4",
 "id": "REG-0018",
 "title": "Kia dealer-portal flaw lets anyone register as a dealer and remotely control cars by license plate, disclosed September 2024",
 "batch": "B2",
 "family": "physical",
 "context": {
  "domain": "Connected vehicle (remote control over authorized channels)",
  "autonomy_level": "supervised",
  "actor_type": "Physical: Kia vehicles made after 2013 with connected services (model years 2014 to 2025 in the researchers' table; the remote functions available vary by model and trim)",
  "actors": {
   "count": 1,
   "text": "1 backend; attacker as a false dealer",
   "roles": [
    "defender"
   ]
  },
  "mandate_context": "demonstration",
  "jurisdiction": [
   "United States (researcher, manufacturer)"
  ],
  "autonomy_level_text": "Machine executes remote commands; no autonomous decision",
  "mandate_context_text": "Demonstration"
 },
 "provenance_tier": "disclosure_corroborated",
 "status": "confirmed",
 "fields": [
  {
   "layer": "Mandate",
   "facet": "principal",
   "value": "The vehicle owner, through Kia's owner portal; dealers, through a dealer portal",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  },
  {
   "layer": "Actor",
   "facet": "status",
   "value": "The vehicle's remote-command system, acting on commands from the account recorded as the vehicle's primary owner; the researchers had made their own account that owner through the dealer system, which accepted their self-registered account as a dealer",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  },
  {
   "layer": "Inputs",
   "facet": null,
   "value": "A dealer account the researchers registered themselves; the dealer portal did not verify dealer status",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Decision",
   "facet": null,
   "value": "The backend accepted the dealer token and allowed vehicle lookup by VIN (the researchers converted license plates to VINs with a third-party service), then reassignment of the vehicle to a new owner account",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Envelope",
   "facet": "authority",
   "value": "A dealer token gave access to the dealer functions (owner lookup, owner demotion, adding an owner) for pretty much any Kia vehicle made after 2013, in the researchers' words; no binding between the dealer account and the vehicles it serviced",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Action",
   "facet": null,
   "value": "Remote lock and unlock, start and stop, horn, and location, on vehicles the researchers did not own",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false
  },
  {
   "layer": "Outcome",
   "facet": null,
   "value": "State: averted by disclosure. No harm reported: the researchers write that the Kia team validated the flaw was never exploited maliciously, and that they disclosed it publicly on 26 September 2024 after validating that it had been remediated. As of Sep 2024.",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  },
  {
   "layer": "Evidence",
   "facet": "event",
   "value": "Researchers' write-up with demonstration. The researchers' timeline records that on 14 August 2024 the Kia team said it had remediated the flaw and was performing testing, and that the researchers disclosed publicly on 26 September 2024 after validating the remediation. Wired's report of the same day gives a different account: shortly after the June report Kia made a change that, the researchers say, appeared to block their technique, and in August Kia told the researchers it had validated their findings but was still working on a permanent fix. Kia's public statement in the linked records is its June 2024 reply to Wired that it was investigating: 'We take this matter very seriously, and value our collaboration with security researchers.'",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY",
    "WIRED"
   ],
   "confidence": "high",
   "disputed": true
  },
  {
   "layer": "Recovery",
   "facet": "technical",
   "value": "Backend fix by the manufacturer",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  },
  {
   "layer": "Recovery",
   "facet": "accountability",
   "value": "None; coordinated disclosure",
   "assertion_type": "assertion",
   "source_ids": [
    "CURRY"
   ],
   "confidence": "high",
   "disputed": false,
   "downgraded_by": "verifier"
  }
 ],
 "controls": {
  "failed": [
   {
    "id": "C-A1",
    "note": "Dealer identity verification",
    "confidence": "high",
    "basis": "curated"
   },
   {
    "id": "C-A2",
    "note": "Dealer-to-vehicle authority binding",
    "confidence": "high",
    "basis": "curated"
   }
  ],
  "succeeded": [
   {
    "id": "C-O1",
    "note": "Coordinated disclosure and pre-publication fix",
    "confidence": "high",
    "basis": "curated"
   }
  ],
  "absent": [
   {
    "id": "C-I4",
    "note": "Owner notification on access changes: the researchers write that, from the victim's side, there was no notification that the vehicle had been accessed or its access permissions modified",
    "confidence": "medium",
    "basis": "curated"
   }
  ]
 },
 "applicable_rules": [
  "UN R155 (vehicle cybersecurity management) for newer markets; not directly applicable in the United States"
 ],
 "unmapped": [],
 "corrections": [
  {
   "date": "2026-10-13",
   "field": "context.jurisdiction",
   "old": "United States (researcher | manufacturer)",
   "new": "United States (researcher, manufacturer)",
   "reason": "jurisdiction text was split at a comma inside parentheses"
  },
  {
   "date": "2026-10-13",
   "field": "fields and sources",
   "old": "lookup 'by licence plate' in Kia's backend; 'manufacturer confirmed the fix'",
   "new": "lookup by VIN, plate converted outside Kia's systems; who confirmed the fix, as the researchers record it",
   "reason": "claims aligned to what each linked record says, found on review"
  },
  {
   "date": "2026-10-14",
   "field": "reviewed_by",
   "old": "none",
   "new": "Saurabh Bhatnagar (editor)",
   "reason": "case checked by the editor against its linked records"
  },
  {
   "date": "2026-10-14",
   "field": "named_parties[Kia].right_of_reply",
   "old": "{\"offered\": null, \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "reason": "right of reply offered by email from register@secureautonomous.com to jbell@kiausa.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction"
  },
  {
   "date": "2026-10-14",
   "field": "controls",
   "old": "absent candidate 'Owner notification on ownership reassignment'",
   "new": "removed",
   "reason": "verifier rule 10: no linked source shows owner notification was absent; an unmentioned control is not recorded as absent"
  },
  {
   "date": "2026-10-16",
   "field": "inference.value",
   "old": "The vehicle did nothing wrong; it obeyed a valid token. The failure is entirely in Actor authentication and Envelope authority at the backend, which is why this case belongs in a register of autonomous action even though the car decided nothing",
   "new": "The vehicle did nothing wrong: it obeyed a valid command. The failure was in the backend, in who could get a dealer credential and how much authority that credential carried. That is why a case where the car decided nothing belongs in a register of autonomous action.",
   "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged"
  },
  {
   "date": "2026-10-16",
   "field": "title and fields",
   "old": "British spelling (licence plate, licence plates)",
   "new": "American spelling (license plate, license plates)",
   "reason": "Spelling standardized to American English for a US readership; no change of meaning"
  },
  {
   "date": "2026-10-18",
   "field": "named_parties[Kia].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"acknowledged\": \"2026-10-15\"}",
   "reason": "Kia's media contact replied on 15 October 2026 that the letter had been forwarded to Kia's Connected Car team for review; receipt acknowledged, no statement yet, nothing published from the reply; recorded at the editor's instruction"
  },
  {
   "date": "2026-10-20",
   "field": "context.actor_type",
   "old": "Physical: Kia vehicles 2013 onward with connected services",
   "new": "Physical: Kia vehicles made after 2013 with connected services (model years 2014 to 2025 in the researchers' table; the remote functions available vary by model and trim)",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the researchers' write-up (CURRY) says the attack worked on 'pretty much any Kia vehicle made after 2013 (see \"Vehicles Affected\" table for specifics)'; its table runs from model year 2014 to 2025 and shows some trims with location only or no remote functions. '2013 onward' included a model year the source excludes."
  },
  {
   "date": "2026-10-20",
   "field": "fields.Actor status",
   "old": "The vehicle's remote-command system, acting on commands from an actor it believed was a dealer",
   "new": "The vehicle's remote-command system, acting on commands from the account recorded as the vehicle's primary owner; the researchers had made their own account that owner through the dealer system, which accepted their self-registered account as a dealer",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the researchers' write-up (CURRY) shows the dealer token was used to demote the owner and then 'assign our attacker-controlled email as the primary owner of the vehicle. This will allow us to send arbitrary commands to the vehicle.' The commands reached the car as the owner's, not as a dealer's; the dealer misidentification was in the dealer system."
  },
  {
   "date": "2026-10-20",
   "field": "fields.Envelope authority",
   "old": "A dealer token conferred authority over any vehicle in the fleet; no binding between the dealer and the vehicles it serviced",
   "new": "A dealer token gave access to the dealer functions (owner lookup, owner demotion, adding an owner) for pretty much any Kia vehicle made after 2013, in the researchers' words; no binding between the dealer account and the vehicles it serviced",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the researchers' write-up (CURRY) says the token gave access to 'all dealer endpoints' and that the four requests worked on 'pretty much any Kia vehicle made after 2013 (see \"Vehicles Affected\" table for specifics)'; 'any vehicle in the fleet' went further than the source."
  },
  {
   "date": "2026-10-20",
   "field": "fields.Outcome",
   "old": "State: averted by disclosure. No harm reported; fix deployed August 2024 before publication. As of Sep 2024.",
   "new": "State: averted by disclosure. No harm reported: the researchers write that the Kia team validated the flaw was never exploited maliciously, and that they disclosed it publicly on 26 September 2024 after validating that it had been remediated. As of Sep 2024.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: neither linked record says the fix was deployed in August 2024. The researchers' timeline (CURRY) records only that on 14 August 2024 the Kia team said it 'had remediated the vulnerability and were performing testing', and that they published on 26 September 2024 'after validating it had been remediated'; Wired (26 September 2024) reports a change shortly after the June report and, in August, a permanent fix still in progress (see Evidence)."
  },
  {
   "date": "2026-10-20",
   "field": "fields.Evidence event",
   "old": "{\"value\": \"Researchers' write-up with demonstration; Kia told the researchers on 14 August 2024 that it had remediated the flaw, and the researchers confirmed the fix before publishing\", \"source_ids\": [\"CURRY\"], \"disputed\": false}",
   "new": "{\"value\": \"Researchers' write-up with demonstration. The researchers' timeline records that on 14 August 2024 the Kia team said it had remediated the flaw and was performing testing, and that the researchers disclosed publicly on 26 September 2024 after validating the remediation. Wired's report of the same day gives a different account: shortly after the June report Kia made a change that, the researchers say, appeared to block their technique, and in August Kia told the researchers it had validated their findings but was still working on a permanent fix. Kia's public statement in the linked records is its June 2024 reply to Wired that it was investigating: 'We take this matter very seriously, and value our collaboration with security researchers.'\", \"source_ids\": [\"CURRY\", \"WIRED\"], \"disputed\": true}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the researchers' timeline (CURRY) says '08/14/24 ... Response from Kia team indicating they had remediated the vulnerability and were performing testing'; Wired (Andy Greenberg, 26 September 2024) reports that 'in August, Kia told the researchers it had validated their findings but was still working on implementing a permanent fix', after an earlier change that 'appeared to block their technique, the researchers say'. Both accounts are recorded and the field is marked disputed. Kia's own words, as quoted by Wired, are added under rule 16: the fix and the no-exploitation finding are otherwise reported by the researchers, not in a public Kia statement."
  },
  {
   "date": "2026-10-20",
   "field": "inference.value",
   "old": "The vehicle did nothing wrong: it obeyed a valid command. The failure was in the backend, in who could get a dealer credential and how much authority that credential carried. That is why a case where the car decided nothing belongs in a register of autonomous action.",
   "new": "The vehicle did nothing wrong: it obeyed a valid command. The failure was in the backend, in who could get a dealer credential and how much authority that credential carried. That is why a case where the car decided nothing belongs in a register of autonomous action. The record does not say what was changed in the backend to fix it, and the accounts of when it was fixed differ.",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the interpretation did not say what the record does not show (rule 17). Neither the researchers' write-up (CURRY) nor Wired describes the change made to the backend, and the two give different accounts of the fix's timing (June change and August 'permanent fix' still in progress, per Wired; remediation reported on 14 August 2024, per the researchers). The interpretation was already unsigned; the editor signs the new wording."
  },
  {
   "date": "2026-10-20",
   "field": "inference.source_ids",
   "old": "[\"CURRY\"]",
   "new": "[\"CURRY\", \"WIRED\"]",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the added sentence on the differing fix accounts rests on Wired (26 September 2024) as well as the researchers' write-up."
  },
  {
   "date": "2026-10-20",
   "field": "sources.CURRY.date",
   "old": "2024-09-20",
   "new": "2024-09-26",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: the write-up is headed 'September 20, 2024', but its own timeline says '09/26/24 08:15 AM UTC - Disclosed vulnerability publicly', and Wired reported the disclosure as 'Today' on 26 September 2024. The page heading is kept in a date note."
  },
  {
   "date": "2026-10-20",
   "field": "sources.WIRED",
   "old": null,
   "new": "{\"title\": \"Millions of Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug (WIRED, Andy Greenberg)\", \"type\": \"press_pointer\", \"url\": \"https://www.wired.com/story/kia-web-vulnerability-vehicle-hack-track/\", \"via_press\": true, \"date\": \"2024-09-26\", \"tier\": \"disclosure_corroborated\", \"interest\": null, \"primary\": false, \"checked\": \"2026-10-20\"}",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: added for Kia's own statement to Wired in June 2024 and for Wired's account of what Kia told the researchers in August 2024, which differs from the researchers' timeline (WIRED, 26 September 2024)."
  },
  {
   "date": "2026-10-20",
   "field": "sources.*.checked",
   "old": "2026-10-13",
   "new": "2026-10-20",
   "reason": "Found in the editor's source re-check of 19-20 October 2026: every cited source re-opened and read in this re-check."
  },
  {
   "date": "2026-10-21",
   "field": "controls.C-I4",
   "old": null,
   "new": "{\"bucket\": \"absent\", \"id\": \"C-I4\", \"note\": \"Owner notification on access changes: the researchers write that, from the victim's side, there was no notification that the vehicle had been accessed or its access permissions modified\", \"confidence\": \"medium\", \"basis\": \"curated\"}",
   "reason": "Editor's classification call of 21 October 2026 (call 17, accepted from pull request #74): restores the owner-notification control removed on 14 October 2026 under verifier rule 10, now that a linked source states it was absent: Curry and others, 'Hacking Kia': 'From the victim's side, there was no notification that their vehicle had been accessed nor their access permissions modified.' Mapped to warnings designed as alerts (C-I4) at medium confidence rather than kept as an unmapped candidate."
  },
  {
   "date": "2026-10-22",
   "field": "named_parties[Kia].right_of_reply",
   "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"acknowledged\": \"2026-10-15\"}",
   "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"acknowledged\": \"2026-10-15\", \"followups\": [{\"sent\": \"2026-10-22\", \"covers\": \"Wired's account that the fix was not yet permanent in August 2024; owner notification on access changes recorded as absent\"}]}",
   "reason": "right of reply recorded by a human"
  }
 ],
 "created": "2026-10-06",
 "last_reviewed": "2026-10-22",
 "actor_status": "confirmed",
 "provenance_tier_text": "Researcher disclosure; manufacturer fix before publication",
 "status_text": "Confirmed (demonstrated; no exploitation known)",
 "outcome": {
  "state": "averted_by_disclosure",
  "severity": "none (demonstration)",
  "affected_parties": [],
  "cost": "none",
  "regime_consequence": "none",
  "as_of": "Sep 2024",
  "derived_by": "backfill-curated"
 },
 "inference": {
  "value": "The vehicle did nothing wrong: it obeyed a valid command. The failure was in the backend, in who could get a dealer credential and how much authority that credential carried. That is why a case where the car decided nothing belongs in a register of autonomous action. The record does not say what was changed in the backend to fix it, and the accounts of when it was fixed differ.",
  "source_ids": [
   "CURRY",
   "WIRED"
  ],
  "confidence": "high",
  "signed_by": "Saurabh Bhatnagar",
  "signed_on": "2026-10-21"
 },
 "named_parties": [
  {
   "name": "Kia",
   "right_of_reply": {
    "offered": "2026-10-14",
    "response": null,
    "acknowledged": "2026-10-15",
    "followups": [
     {
      "sent": "2026-10-22",
      "covers": "Wired's account that the fix was not yet permanent in August 2024; owner notification on access changes recorded as absent"
     }
    ],
    "assessed_through": "2026-10-22",
    "assessments": [
     {
      "through": "2026-10-22",
      "date": "2026-10-22",
      "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering",
      "triggered": [],
      "note": "no correction since the offer adds or worsens a claim about this party in words that are not its own"
     }
    ]
   }
  }
 ],
 "sources": {
  "CURRY": {
   "title": "Sam Curry, Neiko Rivera, Justin Rhinehart, Ian Carroll, Kenneth Lugo, 'Hacking Kia: Remotely Controlling Cars With Just a License Plate'",
   "type": "researcher",
   "url": "https://samcurry.net/hacking-kia",
   "via_press": false,
   "date": "2024-09-26",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": true,
   "checked": "2026-10-20",
   "date_note": "the page is headed 20 September 2024; the authors' timeline records public disclosure on 26 September 2024, the day Wired reported it"
  },
  "WIRED": {
   "title": "Millions of Vehicles Could Be Hacked and Tracked Thanks to a Simple Website Bug (WIRED, Andy Greenberg)",
   "type": "press_pointer",
   "url": "https://www.wired.com/story/kia-web-vulnerability-vehicle-hack-track/",
   "via_press": true,
   "date": "2024-09-26",
   "tier": "disclosure_corroborated",
   "interest": null,
   "primary": false,
   "checked": "2026-10-20"
  }
 },
 "derived_by": "backfill-curated",
 "reviewed_by": "Saurabh Bhatnagar (editor)"
}