A security researcher working with Sam Curry identified significant vulnerabilities in a major automaker’s connected car platform that could enable unauthorized remote unlocking of vehicles in most of the world.
The researcher began by analyzing the automaker’s mobile app after purchasing a new SUV with access to the connected car platform in 2023. By decompiling the APK file, they reconstructed API requests and discovered that nearly all consumer application communications routed through a telematics domain.
A key vulnerability emerged through an admin tool subdomain that presented a login screen for what appeared to be internal infrastructure. The tool’s JavaScript bundle revealed a rich API allowing employees to interact with customer accounts and production vehicles with minimal restrictions. Critically, many of these APIs required no authentication beyond hardcoded API keys embedded directly in the JavaScript bundle.
The researcher documented a complete attack chain: starting with a vehicle’s license plate number, they could retrieve the vehicle identification number (VIN) through public Australian state-based registration lookup sites. Using the VIN, they accessed an API that returned a subscriber GUID, which then yielded full account details including email addresses registered on the automaker’s ForgeRock OpenIDM identity platform.
The core vulnerability centered on the identity platform itself. When users authenticate through the mobile app, they receive an authentication token from the identity system. Once obtained, this token grants control over connected vehicle functions including remote unlock, lock, horn, and engine controls. The researchers found the automaker’s OpenIDM instance was externally accessible and discovered hardcoded admin credentials embedded in a vendor JavaScript bundle, apparently intended for a staging environment.
Although the automaker had implemented Web Application Firewall (WAF) rules to block access to sensitive OpenIDM endpoints, the researcher spent days developing path traversal techniques to bypass these protections. The investigation revealed the automaker used ForgeRock’s identity software as the cornerstone of their authentication infrastructure, and this system appeared to have fundamental security weaknesses that were inadequately protected.
Key facts
- A security researcher found vulnerabilities in a major automaker’s connected car platform that could enable unauthorized vehicle unlocking
- The attack chain began with publicly available license plate information and proceeded through VIN lookup, subscriber identification, and account access
- Hardcoded admin credentials for the ForgeRock OpenIDM identity system were discovered embedded in JavaScript bundles
- The researcher identified that obtaining an authentication token would grant full remote control capabilities including unlock, lock, horn, and engine functions
- WAF protections were implemented but the researcher developed path traversal techniques to potentially bypass them