unlocking any car from X brand in most of the world

This report examines the security of a major automaker's connected car platform, revealing significant vulnerabilities that could allow unauthorized access to vehicles worldwide. The investigation began with downloading and decompiling the automaker's car app, revealing that nearly all app communication was routed through the redacted-telematics.com.au domain.

Further exploration uncovered several concerning assets, including a login screen for an "admin tool" subdomain. This admin tool provided a surprisingly robust API allowing full control over customer accounts and production vehicles with minimal authentication restrictions. The primary weakness lay in the vehicle's VIN being easily obtainable through Australian registration databases, enabling the attacker to obtain the Vehicle Identification Number (VIN) needed to link to a subscriber's account.

By leveraging ForgeRock's OpenIDM identity platform, which the automaker heavily relies on, the researchers discovered a vulnerable admin credentials bundle embedded in the JavaScript files. This allowed them to generate user authentication tokens, granting complete control over any connected car through APIs for remote unlocking, locking, and controlling various vehicle functions.

With these findings, the report underscores the critical need for robust security measures in connected car systems to prevent unauthorized access and protect vehicle owners' privacy and safety.