● Covered by 1 source · 1 reportMedium impact1 negative
Security Researchers Find Vulnerability Allowing Remote Unlocking of X Brand Cars Globally
Key points
- Vulnerability found in a major automaker's connected car platform.
- Allowed remote unlocking of X brand cars globally.
- Discovered via decompiling the mobile app and identifying API endpoints.
- Admin tool exposed on the public internet was the entry point.
Discovery of the Vulnerability
Security researchers investigated the connected car platform of a major automaker, referred to as 'X brand'. The investigation began by analyzing the mobile application's APK to reconstruct API requests made when remotely unlocking a car. This led to the identification of primary communication points under '*.redacted-telematics.com.au'.
Exposed Admin Tool
Further reconnaissance revealed an exposed admin tool at 'admintool.redacted-telematics.com.au'. This subdomain, titled 'TEST HARNESS', presented a login screen accessible from the public internet. The presence of such an administrative interface on a public domain indicated a potential security oversight in the automaker's infrastructure.
Implications for Vehicle Security
The vulnerability allowed unauthorized access to vehicle control functions, specifically remote unlocking, across a significant portion of the world where X brand cars operate. This highlights the security risks associated with internet-facing components of connected car systems, which can be exploited if not properly secured.
Focus on Web Application Security
The research focused on compromising internet-facing web applications and infrastructure rather than hardware-specific car hacking. This approach underscores that even with complex hardware, the underlying internet services connecting vehicles can be a critical point of failure if not rigorously secured.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Security researchers discovered a critical vulnerability in a major automaker's connected car platform, allowing unauthorized remote unlocking of vehicles. The flaw was found in an internet-facing admin tool accessible through basic reconnaissance, highlighting risks in connected vehicle infrastructure.