Unlocking any car from X brand in most of the world

This report details the discovery of a vulnerability in a major automaker's connected car platform, making it possible to remotely unlock any vehicle using only the number plate. The author, who has a background in web application security, collaborated with Sam Curry to investigate the platform, finding that most of the infrastructure is hosted on the public internet, with a subdomain (admintool.redacted-telematics.com.au) showing a "TEST HARNESS" login screen.

The admin tool provides a rich API that allows the automaker's employees to interact with customer accounts and vehicles with minimal restrictions. Using this admin tool, the author demonstrates how a number plate can be used to obtain a Vehicle Identification Number (VIN) through state-based registration lookup sites, and then use that VIN to obtain a subscriber or email address.

The email address is then used to obtain an authentication token for the automaker's identity platform, ForgeRock OpenIDM. With this token, the author shows how it is possible to control any user's car remotely, including unlocking, locking, honking the horn, and activating the engine. The vulnerability stems from the use of hardcoded API keys in the JavaScript bundle, and the lack of authentication beyond those keys in the APIs.

The report also highlights the poor security hygiene of the connected car infrastructure, including the use of public internet resources for admin tools and sensitive APIs.