Researcher finds flaw to unlock any car via plate number
Original: Unlocking any car from X brand in most of the world
Why This Matters
Exposes how connected car admin infrastructure can sit wide open on the public internet.
Security researcher Shubs, co-founder of Assetnote, discovered an exposed admin tool on a major automaker's connected car platform that allowed unauthenticated remote vehicle unlocking using only a license plate number.
Working with Sam Curry in July, researcher Shubs reverse-engineered a major automaker's Android app to map its backend infrastructure at a redacted telematics domain. During reconnaissance, they found a publicly accessible subdomain — admintool.redacted-telematics.com.au — labeled 'TEST HARNESS' and serving a full JavaScript bundle before any login occurred.
That bundle contained hardcoded API keys and exposed a rich internal API normally reserved for employees. Crucially, many endpoints required no authentication beyond those embedded keys. Using the API, researchers could look up customer accounts by email address. Combined with the fact that Australian license plates can be easily cross-referenced to a VIN through state registration lookup sites, the chain was nearly complete: plate number → VIN → account lookup → remote vehicle unlock.
The automaker's connected car system was designed to allow remote commands — including unlocking doors — through the same infrastructure. The admin tool's exposure effectively handed those controls to anyone willing to do basic subdomain enumeration. No hardware access required.