Unlocking any car from X brand in most of the world

Remote car unlocking and control capabilities are now demonstrably insecure for owners of this brand.

Security researcher Sam Curry, collaborating with Assetnote co-founder, discovered a critical vulnerability in a major automaker's connected car platform. The flaw allowed unauthorized access to customer data and remote control of vehicles. The researchers found that the automaker's connected car infrastructure, accessible via *.redacted-telematics.com.au, had an exposed admin tool subdomain, admintool.redacted-telematics.com.au. This tool contained hardcoded API keys and lacked robust authentication, enabling access to customer accounts and vehicle data. Further investigation into the automaker's identity management system, ForgeRock OpenIDM, revealed exposed admin credentials in a vendor JavaScript bundle. Despite Web Application Firewall (WAF) protections, the researchers exploited a path traversal vulnerability and discovered a `getUser` endpoint that, when combined with admin credentials, exposed sensitive user information including password hashes and mobile push tokens, bypassing WAF protections without needing path traversal.

The automaker's reliance on hardcoded API keys and exposed admin credentials in publicly accessible JavaScript bundles highlights a widespread issue of insufficient security hygiene in IoT device management. This vulnerability in ForgeRock OpenIDM, a common identity management solution, suggests that other organizations using similar configurations could be at risk. The successful exploitation despite significant WAF investment indicates that perimeter security alone is insufficient against motivated attackers who can leverage supply chain vulnerabilities and misconfigurations.

This incident will likely prompt a reassessment of connected car security standards and potentially lead to stricter regulations regarding the disclosure and handling of customer data by automotive manufacturers. Customers may face increased scrutiny or delays in accessing connected features as companies implement more robust authentication and authorization mechanisms, and potentially phase out older, less secure systems. The ease with which a user's identity and vehicle control could be compromised underscores the need for continuous security auditing and secure development practices throughout the entire product lifecycle.