Chen and Yang - Grand Theft Auto Digital Key Hacking

### Vulnerabilities in Automotive Digital Key Architectures At 00:00, automotive security researchers Chen and Yang (Kevin2600) present research on connected vehicle "digital keys," examining how smartphone apps interact with vehicle telematics systems to unlock doors and start ignitions.

### Connected Telematics and Cloud APIs At 08:00, the speakers analyze the communication flow between mobile companion applications, cloud telematics servers, and in-vehicle electronic control units (ECUs). The architecture relies heavily on standard HTTP REST APIs for remote commands and Bluetooth Low Energy (BLE) for proximity-based entry.

### Intercepting Mobile Telematics API Traffic At 16:00, Chen and Yang demonstrate capturing and analyzing mobile app network traffic. Due to missing SSL certificate pinning and weak token validation on the backend, researchers extracted hardcoded API credentials and intercepted vehicle control commands.

### Flawed Virtual Key Delegation At 24:03, the presenters expose critical logic flaws in virtual key sharing features. Mechanisms designed to let vehicle owners grant temporary vehicle access to third parties suffered from insecure token generation, allowing attackers to forge permissions, extend access indefinitely, and capture permanent master digital keys.

### BLE Replay Attacks and Coordinated Disclosure Concluding between 32:01 and 40:02, the researchers demonstrate sniffing and replaying BLE key packets using software-defined radios and custom mobile transceivers. They recount their coordinated vulnerability disclosure with automotive manufacturers, stressing the need for mutual cryptographic authentication between vehicle secure elements and mobile devices.

(AI summary — Gemini Flash)