The vulnerability exists in the OnStar RemoteLink smartphone app and can exploited using a gadget that can be built by basic components you can get off the internet.
The 29-year-old hacker Samy Kamkar discovered the security flaw and built the device necessary for exploiting it.
Kamkar alerted GM to the problem and they have been working to implement a patch. But as Kamkar pointed out in a tweet, they haven't completely fixed the problem just yet.
OwnStar update: GM told WIRED that OnStar bug was fixed, however it's not actually resolved yet. I spoke with GM & they're working on it now
- Samy Kamkar (@samykamkar) July 30, 2015
Tech Insider reached out to GM to see if this was true, and received the following statement:
GM takes matters that affect our customers' safety and security very seriously. GM product cybersecurity representatives have reviewed the potential vulnerability recently identified.
In working with the researcher, we moved quickly to secure our back-office system and reduce risk. However, further action is necessary on the RemoteLink app itself. We take all cyber matters seriously and an enhanced RemoteLink app will also be made available in app stores soon to fully mitigate the risk.
Read Tech Insider's interview with Kamkar to learn more about the hack.