Unlocking any car from X brand in most of the world

A security investigation by a researcher and Sam Curry traced how the automaker’s connected-car app communicates with its online services, then followed the path from public vehicle information to control of a car. An internet-facing administration tool exposed APIs protected only by keys embedded in its JavaScript. Those APIs could link a vehicle identification number to a subscriber account and reveal personal information. The tool could not directly issue driving commands, but the researchers found that a valid consumer authentication token could operate a car’s remote features, including unlocking and locking it, sounding the horn, and controlling the engine.

The route to that token ran through the automaker’s ForgeRock identity system. A vendor JavaScript bundle contained administrator credentials that also worked against production. Although a web application firewall blocked many identity-management endpoints, a path-encoding variation exposed them; a custom endpoint returned sensitive account data, and the bypass allowed researchers to change users’ passwords. In the Australian environment they tested, a misconfigured password-grant flow also let them authenticate without completing multi-factor authentication. Together, these weaknesses enabled account takeover and remote vehicle control. The investigation shows how exposed administrative tools, embedded credentials, weak access controls, and identity-system misconfigurations can combine into a serious connected-car security failure.