A security researcher discovered a critical vulnerability in a major automaker's connected car platform, allowing anyone to unlock vehicles remotely. By analyzing the mobile app's API and finding hardcoded keys in a JavaScript bundle on an admin subdomain, the researcher gained access to customer accounts and vehicle controls. The flaw exposed subscriber data and enabled VIN-to-email lookups, completing a chain that could unlock any car from just a license plate number.
The vulnerability stemmed from an unauthenticated admin tool at admintool.redacted-telematics.com.au, which lacked proper access controls. Using state registration sites to get VINs from plates, attackers could traverse the API to find owners and unlock vehicles. The automaker's telematics infrastructure left sensitive endpoints publicly accessible, bypassing standard security measures.
This incident highlights the risks of connected car systems and the importance of securing backend APIs. The researcher collaborated with Sam Curry to document the findings, emphasizing that internet-facing services must assume hostile environments. Proper authentication and environment isolation are crucial to prevent such breaches.
Source: Hacker News · Summarized by HeadlinesBriefing