Unlocking any car from X brand in most of the world

I have always had a fondness for this particular car brand. Our family has owned several of their vehicles over the years, and they have served us exceptionally well. In 2023, I purchased a new four-wheel drive/SUV from them, marking the first time I had access to their connected car platform. Initially, I harbored doubts about the security of such platforms, but I put those suspicions aside as life intervened, making it difficult to investigate further.

Recently, in July, I teamed up with Sam Curry to examine the security of a major automaker's connected car systems. For the purposes of this article, I will refer to the automaker as "the automaker."

When contemplating car hacking, the hardware aspect often comes to mind. However, my expertise lies in breaching internet-facing web applications and infrastructure, regardless of the hardware components. All these hardware elements ultimately revolve around services designed to be accessible via the internet.

To begin unraveling the process, I delved into the APK file and decompiled it, reconstructing the API requests the app sent. Most of the communication with the connected car infrastructure seemed to originate from *.redacted-telematics.com.au. The intricacies of managing such infrastructure are manifold, encompassing admin tools, staging, development, and quality assurance environments to ensure a seamless user experience.

It is worth questioning whether all these elements should be openly accessible on the public internet for anyone curious enough to perform basic reconnaissance.

One particular asset stood out: admintool.redacted-telematics.com.au, which displayed a simple login screen with a TEST HARNESS message. Intrigued, I explored the JavaScript bundle, discovering a rich API that granted the automaker's employees extensive access to customer accounts and production vehicles with minimal restrictions.

Many of these APIs relied solely on hardcoded API keys embedded within the JavaScript bundle, with no additional authentication required. For instance, using the car's number plate, we could easily retrieve the Vehicle Identification Number (VIN) through state-based registration lookup sites. This VIN, combined with the subscriber or email address, provided a crucial link in our chain.

With the subscriber GUID obtained, we could access the user's full account details, including the user's email, via the /v1/account endpoint on the automaker's identity platform, ForgeRock OpenIDM. Armed with this information, we could now issue commands to any car we desired. However, the admin tool only enabled us to provision features, add ourselves as secondary users, and generate remote access codes.

None of these capabilities granted us direct control over a vehicle. To overcome this obstacle, Sam and I spent two weeks investigating the automaker's central identity system, which relied heavily on ForgeRock's identity software (OpenAM/OpenIDM). By examining the JavaScript files under *.redacted-telematics.com.au, we stumbled upon a set of cursed vendor JavaScript bundles containing admin credentials for OpenIDM, which appeared to be intended for the staging environment.

Despite the apparent negligence, we believed these credentials might still grant access in the production environment.

Delving into OpenIDM, we discovered that the automaker had invested significant resources in configuring Web Application Firewall (WAF) rules to restrict access to the sensitive APIs typically accessed through /openidm/*.