# Security Researchers Expose Vulnerabilities in Major Automaker's Connected Car Platform A critical chain of flaws allowed unauthorized remote control of vehicles via API exploitation. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/f7ab11a2-a426-4d3d-9119-c4ecff773335 ## Connected Car Security Risks Modern vehicles increasingly rely on internet-facing infrastructure to provide remote features like unlocking doors or starting engines. This connectivity introduces significant attack surfaces, as these systems must remain reachable from the public internet. Researchers investigated a major automaker's platform to determine if these digital conveniences compromised overall vehicle security and user privacy. ## Decompiling the Mobile Application The investigation began by analyzing the automaker's Android application. By decompiling the APK file, researchers successfully reconstructed API requests and identified key infrastructure domains. They discovered that the application communicated extensively with a specific telematics domain, which served as the primary gateway for managing vehicle commands and user account data interactions. ## Exposed Admin Tool Discovery A search for subdomains revealed an 'admin tool' hosted on the public internet. The site, labeled as a test harness, contained a large JavaScript bundle. By auditing this code, researchers found hardcoded API keys that granted access to internal functions, allowing them to interact with customer accounts and production vehicles with minimal restrictions. ## Mapping Plate to Identity The researchers established a chain to link physical vehicles to digital identities. By using Australian state-based registration lookup sites, they converted vehicle number plates into VINs. An internal API then allowed them to map these VINs to subscriber GUIDs, ultimately retrieving sensitive user account PII, including email addresses, from the identity platform. ## Identity System Vulnerabilities The automaker utilized ForgeRock's identity software to manage user authentication. Researchers found an exposed OpenIDM instance and discovered admin credentials embedded within a vendor JavaScript bundle. Although these credentials were intended for staging, they proved functional in the production environment, highlighting a critical failure in basic security hygiene and credential management practices. ## WAF Hardening and Bypasses The automaker had implemented Web Application Firewall rules to protect sensitive ForgeRock APIs. Despite these defenses, researchers identified path traversal vulnerabilities that allowed them to bypass restrictions. By manipulating URL paths, they could interact with restricted endpoints that were previously blocked, demonstrating that perimeter security measures are often insufficient against motivated, persistent attackers. ## Leveraging AI for Exploitation After struggling with manual bypass attempts, the researchers utilized an AI model to analyze OpenIDM source code. The AI identified a specific path traversal combination that successfully bypassed the WAF. This allowed the researchers to access the managed user servlet, which was previously unreachable, effectively opening the door for full account takeover operations. ## Account Takeover Mechanism With the bypass confirmed, researchers could perform a PATCH operation to overwrite the password of any user profile. This action required only the user's GUID and the discovered admin credentials. By changing the password, they gained the ability to authenticate as the victim, effectively bypassing the standard user login process entirely. ## Multi-Factor Authentication Failure The Australian environment featured a critical misconfiguration where multi-factor authentication could be skipped during the token exchange process. Researchers successfully requested an authentication token using the newly set password, then exchanged it for a valid session. This flaw eliminated the final barrier, allowing them to generate legitimate access tokens for any user. ## Remote Vehicle Control Achieved Armed with a valid app access token, the researchers could issue commands directly to the automaker's API. This enabled them to remotely unlock doors, sound horns, or control engine functions for any vehicle associated with the compromised account. The entire chain demonstrated how interconnected vulnerabilities lead to total loss of vehicle control. ## Systemic Security Hygiene Issues The investigation revealed a pattern of poor security practices, including exposed administrative tools, hardcoded credentials, and flawed identity management configurations. These issues were compounded by the reliance on WAFs as a primary defense mechanism rather than addressing the underlying architectural weaknesses. Such systemic failures remain a major concern for the automotive industry. ## Broader Implications for Industry This research highlights the urgent need for robust security in connected vehicle ecosystems. As automakers integrate more digital services, the risk of remote exploitation grows. Companies must prioritize secure development lifecycles, rigorous API testing, and proper identity management to protect users from potential physical and digital harm in an increasingly connected world. ## Sources covering this story - https://shubs.io/unlocking-any-car-from-x-brand-in-most-of-the-world/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._