Researcher demonstrates remote car unlocking via admin tools
Original title: unlocking any car from X brand in most of the world
Decompilation reveals admin interfaces and identity bypasses allowing remote vehicle control from number plates.
A security research post describes decompiling a connected car app to identify calls to the automaker's telematics infrastructure. An admin tool subdomain exposed rich APIs for account management and vehicle features using only hardcoded keys from the JavaScript bundle. Linking vehicle plates to VINs to user accounts via identity services enabled remote unlocking of any vehicle. The system relies on ForgeRock for authentication but the admin path bypasses normal controls.
- Admin tool allows account lookups by email
- Plate to VIN lookup possible via registration sites
- Subscriber GUID enables full account details
- Remote unlock command flow via auth tokens
Impact: remote unlock of any vehicle
- Vendors
- major automaker
- Products
- connected car platform
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | com.redacted.app | Pro=AQIC5wM2LY4Sfcy...* client_id=REDACTED_APP&redirect_uri=com.redacted.app:/oauth2Callback&scope=openid%20profile%20write&response_typ |
From the original article
10 min read at shubs.ioI've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had access to their connected car platform.
By shubs.io via markerz · shubs.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.