Unlock Cars From a License Plate

A photo of your license plate could open your car and start its engine from far away. The car’s locks had nothing to do with it. The way in was an admin password the carmaker had left in its own files.

Two security researchers, Shubham Shah and Sam Curry, spent time earlier this year on the connected-car systems behind two car brands, from two sides. Shah is a co-founder of the Australian security firm Assetnote, and he took the Australian side. Curry has been taking apart car systems for years, and he took the United States. The apps let an owner unlock the doors, start and stop the engine, sound the horn and find the car on a map. Both sign customers in through the same software. That software is where it all fell apart.

Start with what happens when you prove who you are to a car app. You open the app, type your email and password, maybe approve a second step on your phone, and the app gets a token. A token is a short code the server hands back that says this phone may send commands to this car. That sign-in work runs on a server the carmaker owns, built on a product called ForgeRock, now part of Ping Identity. It is an identity platform: one system that holds the customer accounts and decides who gets let in. Get into that one system as an administrator, and you stop being one customer. You become all of them at once.

On the Australian side, Shah started by mapping the carmaker’s web addresses. Big companies run far more than the one site customers see. They park internal tools and test systems on subdomains, the lesser-known addresses that hang off the main domain. While combing through the JavaScript files served from the carmaker’s own telematics domain, he found something that should never leave a developer’s laptop. One of those files, a bundle from an outside vendor, had a working administrator login for the identity server written straight into it. It was meant for a test setup. It worked on the live system too. The accounts of paying customers sat behind a password that was printed in a file the website served to the public.

This was not a sloppy company. Shah found the opposite: they had put a lot of work into firewall rules to block access to the sensitive parts. He respects the hardening, and suspects they knew how bad it was to leave this one system exposed, but that some business reason kept it there anyway. That is worse than a company that never noticed at all.

A web application firewall, or WAF, was supposed to sit in front of that identity server and block outside requests to the sensitive parts before they arrive. It did block the obvious paths. Shah and Curry sat stuck at it for days, until they let an AI model read the identity software’s source code for about six hours. The model found one path, /static, that slipped past the firewall where the others were blocked. The two of them had assumed, as people do, that one blocked path meant all of them were blocked. The server behind the firewall read that same address as a command, and from there the admin login did the rest.

On the United States side, the pair reached a hidden management console on the identity servers, a control panel meant only for the company’s own engineers. It still accepted the default username and password the software ships with. That default is public, and the maker’s own manual says to change it before the system goes live. It had not been changed. From that console Shah set up a scheduled task that ran his own code, which gave them command execution on the production server. Command execution means running programs on the company’s own machine, the one serving its customers, as if you worked there. An administrator on that identity server can read, change or delete a customer record and hand out a fresh session for it, and that is the level of access the two of them now had.

A single lookup, by email address or phone number, handed back the account’s password hash, its PIN hash, the push tokens tied to the owner’s phone, and the person’s full name and mobile number. Push tokens are the identifiers that let a service send notifications to a specific phone. A hash is a one-way scramble of the original value, so the password and the PIN did not come back as readable text. A weak PIN could still be guessed offline later. The push tokens, the number and the name needed no guessing: they sat there in plain form.

Taking over an account did not need the owner’s password at all. Through the admin controls, the researchers changed a chosen account’s email to one they held, then set a new password on it directly. When they signed in through the normal app, the system sent a six-digit verification code to the new email address, which they read. From there the app handed them the same token the owner’s own phone would get. On the owner’s side, nothing changed. Their existing app session stayed logged in while the researchers worked beside it, and once they had the tokens they set the original email back, so the account looked untouched. They could even register a push token of their own, so the alerts a car sends would reach them instead of the owner.

The second step that is meant to protect the account did not help either. In the Australian system, the code or the tap on your phone that normally stands between a stolen password and the account could be skipped through an old sign-in method that should have been retired years ago.

This is the part that reaches your own car in your own driveway. Your car carries a VIN, the vehicle identification number stamped on it at the factory and visible through the windshield. Someone walking past can read it off the glass. In Australia, a plate is enough on its own: it gives you the VIN through the state registration-lookup sites, and the admin tool turned a VIN into the exact account it belonged to. That lookup was a built-in part of the system meant for staff, which is why it answered without complaint. In the United States test, Shah checked a car with its owner standing beside it, then unlocked the doors, started the engine, shut it off and locked it again.

A few things keep this from being a nightmare. These were researchers working with permission. The owner in the test stood beside the car and chose a new password after it was done. The researchers did not name the carmaker in their writeups, because they were asked not to, and they held back the exact web addresses and credentials so others could not follow along. They give no number for how many cars or customers could have been reached, only that it would hit an owner who had the remote features switched on. The response was fast: once they reported it, the carmaker fixed it within about two hours, took down the test code, and changed the exposed passwords. The researchers were given no reward and no public credit for the work.

This is not the first time these two have walked into the car industry through the web instead of through the car. Over the past few years they found ways to reach vehicles from brands like Honda, Nissan, Hyundai and Ford, and later dug into Kia and Subaru. Four years ago, in that same stretch of work, they pulled a staging key out of the JavaScript on a Ferrari dealer web page and used it to reach Ferrari’s production systems. From there they could read, change or delete any customer’s account and change its role, and the dealer back office even handed back a set of live service credentials in plain text. Same mistake, a different brand: a test key left where the public could reach it.

Each time the way in was an account or dealer system, not anything mechanical on the vehicle. The finding keeps coming back the same way. The car itself is usually solid. The website and the app behind it are the way in, because they are built fast, wired to live customer data, and harder to lock down than the thing they control.

A few weeks ago I wrote here about how car apps quietly send your VIN off to advertising and tracking firms. It is the same number, pointed at a different danger. In that story it ties your car to your shopping and your movements. In this one it is the first link in a chain that ends with your doors open and your engine running. The number was never meant to be a secret. It is printed on the glass on purpose. That becomes the trouble when a login system treats something people can read off a parked car as something only the owner should know.

You cannot do much about a carmaker’s server, since that part is on them. What you can do is treat your VIN as more public than the apps pretend. Think twice before feeding it into lookup and valuation sites. And remember that the remote features in a car app are only as safe as the company’s weakest web address. This break-in did not need a cut wire or a scanner held near the door. It needed a laptop, a phone app read line by line, and a login the company forgot to lock. On a modern car, the account behind the app has become the way in, long before the lock on the door.

Want to see what your own car app sends the moment you press unlock? Route your phone’s traffic through a proxy you control and read it. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

Sam Curry | Shubham Shah