#BEWARE: A REMOTE-START APP EXPOSED THOUSANDS OF CARS TO HACKERS

LAST WINTER, A hacker who goes by the handle Jmaxxz was looking for a Christmas present for his girlfriend. She’d recently flown back from a work trip and complained that her fingers had been painfully cold on her drive home from the airport, thanks to below-freezing winter weather and a circulatory system condition known as Raynaud’s disease. So Jmaxxz had the idea to buy her a remote starter that would connected to her car’s dashboard and, with an accompanying device and app called Linkr, allow her to start the car's engine with a tap on her phone. That way, on her next trip, she could start heating up the car as soon as her plane touched down.

RED-ALERT: 1.4 BILLION IPAD AND IPHONE USERS CAN BE HACKED. WARNING ISSUED

In a talk at the Defcon hacker conference today in Las Vegas, Jmaxxz described a series of vulnerabilities in MyCar, a system made by Canadian company Automobility, whose software is rebranded and distributed under names including MyCar Kia, Visions MyCar, Carlink, and Linkr-LT1. MyCar's devices and apps connect to radio-based remote start devices like Fortin, CodeAlarm, and Flashlogic, using GPS and a cellular connection to extend their range to anywhere with an internet connection. But with any of three different security flaws present across those apps—which Jmaxxz says he reported to the company and have since been fixed—he says he could have gained access to MyCar's database backend, letting him or a less friendly hacker pinpoint and steal any car connected to the MyCar app, anywhere in the world.

Over just 13 days, it had collected 2,000 location of car.