Unlocking any car from X brand in most of the world

Security researchers Shubham Shah and Sam Curry uncovered systemic authorization and credential exposure vulnerabilities across the connected car and identity architecture of a major automaker, documenting how external web services allowed the compromise of vehicle telemetry systems according to shubs.io's report. By decompiling the automaker's official Android consumer application APK and mapping internet-facing cloud endpoints, the researchers discovered that internal management portals and central identity providers were directly reachable on the public internet without adequate access barriers. The investigation demonstrated that attackers could bridge vehicle license plate registrations with backend telemetry platforms to target production vehicles without requiring hardware manipulation.

This investigation examines the reconnaissance path, the misconfigurations identified in web bundles, and the authentication bypass techniques evaluated against the automaker's identity infrastructure. The findings serve security engineers, automotive software architects, and enterprise identity administrators who manage connected vehicle fleets, API gateways, and web application firewalls. It highlights the security risks introduced when internal diagnostic utilities, administrative interfaces, and central directories are exposed externally rather than sequestered behind enterprise virtual private networks.

01What actually changed

The investigation revealed that the automaker deployed public-facing infrastructure that exposed sensitive administrative functions to unauthenticated users. By analyzing network traffic in the decompiled Android APK, researchers identified primary API communication routed through subdomains under redacted-telematics.com.au.

Rather than restricting administrative tooling to corporate networks, the automaker maintained an externally accessible test harness at admintool.redacted-telematics.com.au. This deployment exposed single-page application client bundles that shipped internal operational logic directly to public web browsers, giving outsiders full visibility into vehicle provisioning interfaces and customer service utilities.

Additionally, the administrative portal relied on static, hardcoded API keys embedded directly within client-side JavaScript files rather than enforcing robust server-side session checks. These exposed endpoints allowed arbitrary querying of internal customer records, including looking up user accounts by email address. This architectural gap meant that operational tools designed for internal employee management could be repurposed by external actors to query vehicle records and modify subscriber settings without verified employee credentials.

02How it works

The exploit workflow operated as a multi-stage reconnaissance and account-linking process spanning public vehicle registries, exposed administrative APIs, and enterprise identity infrastructure. An attacker could start with an Australian vehicle registration number plate and look up the corresponding Vehicle Identification Number using state-based registration lookup portals.

With the VIN in hand, the attacker queried the automaker's exposed administrative API, which returned the owner's unique subscriber GUID without requiring authenticated corporate sessions. Calling the platform's account endpoint with that GUID subsequently yielded the subscriber's registered email address and personal account records.

To translate account access into vehicle commands such as unlocking doors, sounding horns, or starting the engine, attackers needed consumer authentication tokens issued by the central identity provider at login.redacted-identity.com.au. The automaker managed identities using ForgeRock OpenIDM software at openidm.redacted-identity.com.au.

Combing through associated JavaScript files under the telematics domain revealed embedded administrator credentials meant for staging environments that also functioned on production systems. Attackers attempted path traversal sequences like /XUI/..%2fopenidm/endpoint to circumvent Nginx Web Application Firewall rules that blocked direct calls to /openidm/ paths, obtaining admin JWTs while probing accessible endpoint whitelists configured for mobile client communications.

03Why it matters

This research demonstrates that physical automotive security is fundamentally bound to the hygiene of internet-facing web infrastructure. Modern connected cars communicate continuously with cloud gateways, meaning software defects on web servers expose physical vehicle controls to remote exploitation. Hardware-level security controls and on-board controller area network bus protections offer minimal defense when cloud backends accept unauthorized command instructions issued with validly minted identity tokens.

Furthermore, the vulnerability chain underscores the severe risk of hardcoding operational credentials and administrative tools into client-facing web bundles. Single-page web applications frequently ship extensive administrative logic, unminified routing information, and API keys to unauthenticated client sessions. When enterprise identity providers like ForgeRock OpenIDM and administrative test harnesses are placed on public domains, perimeter protections like web application firewalls serve only as temporary friction rather than true defense in depth against determined adversaries.

04Who is affected

The exposure directly impacted owners and fleet operators of the automaker's connected vehicles across Australia and international regions relying on the same centralized telematics platform. Vehicles running connected services through the automaker's consumer mobile application were reachable through the exposed backend APIs. Because vehicle registration databases allow anyone to look up a VIN from a license plate, vehicle owners parked in public spaces were susceptible to targeted reconnaissance through their visible registration plates.

Enterprise customers and fleet administrators utilizing the automaker's connected management suites faced similar exposure. Because the administrative harness allowed provisioning features, generating remote access codes, and assigning secondary users to existing customer accounts, attackers could establish persistent unauthorized access across customer profiles. Any vehicle linked to subscriber GUIDs managed within the automaker's ForgeRock OpenIDM instance remained vulnerable to unauthorized account mapping and remote command requests.

05What to watch

Organizations operating connected vehicle fleets must review their external attack surfaces and eliminate public access to administrative portals and identity management backends. Security teams must ensure that staging and development configurations, hardcoded API keys, and internal management harnesses are barred from production JavaScript bundles. Internal management assets such as admintool portals must be relocated behind strict corporate single sign-on mechanisms or private network perimeters rather than relying on web application firewall filtering.

Automotive software vendors must also enforce strict credential separation between staging, quality assurance, and production environments. Embedding staging administrator credentials inside production web bundles represents an ongoing systemic failure that allows attackers to compromise production identity providers. Future security audits must prioritize backend identity federation routines, mobile app endpoint whitelisting, and strict authorization boundary validation between user accounts, subscriber GUIDs, and vehicle command gateways.