Critical Security Flaws in Tata Motors' iRA App: Risks of Smart Car Hacking and Mitigation Strategies
India's cyber security agency, CERT-In, has identified four major vulnerabilities in Tata's connected car applications that could grant hackers access to vehicle remote controls and sensitive data.
In today's modern era, a car is no longer just a machine of iron and engine, but has become a large computer on wheels. Leading companies like Tata Motors provide connected car technology in their vehicles, which allows you to lock or unlock the car or check its status via a smartphone. However, the Indian government's cybersecurity agency, CERT-In (Indian Computer Emergency Response Team), has recently warned of serious security flaws in this technology. These flaws have been found in Tata Motors' iRA 2.0 and iRA.ev applications, which could put the data of millions of customers and the security of their vehicles at risk.
A connected car is a vehicle that can engage in bidirectional communication with external systems. According to Wikipedia, this connectivity is used to provide passengers with services such as music, navigation, and software updates. Tata Motors uses the iRA 2.0 app for its petrol-diesel vehicles and the iRA.ev app for its electric vehicles (EVs). Through these apps, users can issue remote commands, monitor vehicle health, and view trip details. But if the app itself is insecure, it becomes an open door for hackers.
| Application Name | Affected Version | Secure (Updated) Version |
|---|---|---|
| iRA 2.0 (Petrol/Diesel) | 26.7.3 and older | 26.8.2 or higher |
| iRA.ev (Electric Vehicles) | 26.7.2 and older | 26.9.1 or higher |
In an advisory issued on November 5, 2026, CERT-In has categorized these flaws as 'High', meaning they are extremely serious. According to the agency's report, there are four major security vulnerabilities in older versions of these apps. By exploiting these vulnerabilities, any skilled hacker can steal a user's credentials, i.e., login details. Not only that, but they could also gain unauthorized control over the vehicle's digital services by impersonating the user. This news is a matter of concern for millions of people using Tata cars because it is directly linked to their personal information and vehicle security.
The first major flaw is due to the presence of 'hardcoded credentials' within the app. This means that certain important digital keys, such as API keys and authorization tokens, were permanently written into the app's programming code. This is a mistake similar to hiding the key to a house's main door under a mat. If a hacker decodes the app, they can obtain these keys. Using these keys, they can reach the company's backend server and modify sensitive data.
The second flaw was found in the app's 'WebView' feature. WebView is a technology that allows a web page to be opened directly inside a mobile app. According to CERT-In, Tata's app did not adequately check which URL or source the WebView was loading content from. Taking advantage of this, a hacker could send a fake link to a user and thereby steal a live authentication token. Once this token is in the hacker's hands, they can log into the app posing as the genuine user.
- Sending a malicious linkThe hacker sends the user a link designed to be opened within the app.
- Insufficient validationThe app's WebView feature loads the link without verifying its source sufficiently.
- Token theftThe user's live authentication token is stolen via the web page.
- Unauthorized accessUsing the stolen token, the hacker logs into the server as the genuine user and misuses the services.
The third issue is related to the app's 'development and debugging logs'. Normally, when an app is being developed, logs are created to keep a record of its processes. In these Tata apps, user authentication tokens were being saved in these logs. If a local attacker gains access to the user's phone, they can read these log files and obtain the token. This allows them to misuse the user's account and access vehicle details.
The fourth and final flaw pertains to the improper implementation of 'SSL Certificate Pinning'. The function of this technology is to ensure that the app is communicating exclusively with the company's secure server. According to a report by Amar Ujala, because this security mechanism was not properly enforced, a hacker could intercept network traffic in transit. This is known as a 'Man-in-the-Middle' attack, wherein a hacker can read or modify the communication between the app and the server.
Many people will wonder whether a hacker can actually drive the car. According to a report by Aaj Tak, there has been no incident so far where a hacker has taken control of a moving vehicle. However, since remote commands can be issued through these apps, a hacker can unlock or lock the car doors. They can track the car's live location and check the status of the battery or fuel. This matter is hazardous from the perspective of both privacy and security, especially when valuable items are in the car or it is parked in an insecure location.
Tata Motors' headquarters are located in Mumbai, and the company has taken immediate steps to rectify these vulnerabilities. CERT-In has advised all users to update their apps to the latest version. Customers using iRA 2.0 must upgrade to version 26.8.2 and those using iRA.ev to version 26.9.1 or higher. Continuing to use older versions is akin to inviting hackers.
The history of connected cars is quite old. General Motors introduced the first connected car features in 1996 with a system named 'OnStar'. Initially, this technology was only for obtaining emergency assistance in the event of an accident. Remote diagnostics were introduced in 2001, and in 2014, Audi launched 4G LTE Wi-Fi hotspots. As technology has advanced, the risks of hacking have also increased. In 2016, researchers proved that approximately 100 million Volkswagen cars could be unlocked remotely.
The trend of connected cars is now growing in India as well. These features are available in popular cars like Tata's Altroz, Nexon, and Safari. Being a smart car means that you do not just have to take care of its tires and engine, but you must also keep its software updated. Cybersecurity experts say that users should never click on unknown links and should immediately contact the company if any suspicious activity is noticed in the app.
In the future, V2X (Vehicle-to-Everything) technology is set to arrive, in which vehicles will communicate with road infrastructure and other vehicles as well. This will reduce accidents, but cybersecurity challenges will become more complex. This incident involving Tata Motors reminds us that while technology provides convenience, it also demands caution. If you drive a Tata connected car, go to the Play Store or App Store today, check the version of your iRA app, and update it.
