Jmaxxz - Your Car is My Car

Connected Car Telematics Exploitation

Jmaxxz presents research disclosing critical vulnerabilities in a major connected car telematics platform that allowed unauthorized remote control and tracking of vehicles across an entire fleet.

Connected Car Architecture

Modern connected vehicles include a telematics control unit (TCU) that maintains a persistent cellular connection to the manufacturer's cloud platform, enabling remote lock/unlock, geofencing alerts, remote engine start, and location tracking through a smartphone app.

API Authentication Bypass

Reverse engineering the companion mobile application reveals the telematics API structure. Jmaxxz discovers that the API uses a predictable vehicle identifier (VIN-derived) as the primary authorization token, allowing enumeration and impersonation of any vehicle in the fleet.

Unauthorized Remote Control

With the authorization token, any registered account holder can remotely unlock, locate, and start any vehicle in the fleet — not just vehicles they own. The talk demonstrates unlocking a vehicle belonging to a consenting third party from miles away, then tracking its real-time location.