GoKawiilResearchers find flaw letting attackers unlock cars from major automaker's connected platform
A security researcher, working with Sam Curry, reverse-engineered the mobile app for a major automaker's connected-car system and traced its network calls to a backend telematics domain. Investigating that infrastructure, they identified an administrative tool and related systems that could potentially be abused to remotely unlock vehicles without authorization.
GoKawiil's interpretation of the reporting above, not reported fact.
The finding suggests that vulnerabilities in backend web infrastructure, rather than vehicle hardware, can expose large numbers of connected cars to remote unauthorized access. It underscores researchers' broader point that automakers' security posture increasingly depends on cloud and API protections as much as on-vehicle defenses.
- A researcher decompiled a car brand's app to trace its backend API calls.
- An admin tool tied to the automaker's telematics domain was discovered during the research.
- The work highlights how web-facing infrastructure, not just hardware, can be a car-hacking attack surface.
Source: shubs.io, 2026-11-09
Published there as: “Unlocking any car from X brand in most of the world”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.