Unlocking any car from X brand in most of the world
629 points
• 3 days ago
• Article
Link
这项安全研究始于对一家主要汽车制造商的互联车载平台进行调查，原因在于他们对现代联网汽车系统的安全性抱有质疑。研究人员对官方 Android 应用进行反编译，并分析 API 请求后发现，该平台主要依赖一组远程通信（Telematics）子域名。其中，在一个管理工具（Admin Tool）子域名中发现了关键漏洞。尽管这个子域名对外开放到互联网，但其 JavaScript bundle 里却硬编码了 API keys 。正是这一发现让研究人员能够枚举用户账户并获取敏感信息，包括把车辆号牌与特定车主的订阅者 GUID（subscriber GUID）以及邮箱地址建立关联。
虽然管理工具提供了大量数据访问能力，但并不能直接控制车辆功能。研究人员随后将目标转向该汽车制造商的核心身份平台，该平台使用 ForgeRock 的 OpenIDM 软件。在进一步审查应用的 JavaScript bundle 后，他们发现其中嵌入了该身份系统的管理员凭据。尽管该汽车制造商已通过 Web Application Firewall（WAF）规则来保护敏感的 OpenIDM 端点，但研究人员发现这些防护并不完整。
要绕过 WAF，关键在于找到一个特定的路径遍历（Path Traversal）漏洞。初步尝试因严格的 Servlet 路由而被阻挡，但后续自动化测试定位到一种可绕过的方式：在 URL 前缀中使用 `/static%2f..%2fopenidm/`，从而彻底绕过防火墙。凭借这一能力，研究人员得以访问内部 API，并可覆盖平台上任意账户的用户密码。能够重置密码后，他们成功绕过身份验证流程以规避多因素认证（Multi-factor Authentication），从而真正获得了对用户身份会话的完全控制。
当他们能够签发有效的消费者访问令牌（consumer access tokens）后，最后一步就是对车辆执行远程指令。研究人员将获取到的 subscriber GUID 与新签发的 access tokens 结合起来，就能从车辆号牌出发，远程发送解锁车门或启动引擎的指令。完整的攻击链最终证明，这些车辆的安全性依赖于一系列脆弱且相互耦合的数字系统。
这项研究后来扩展到澳大利亚市场之外，表明为美国、加拿大和欧洲提供服务的该汽车制造商基础设施中，也存在类似但更为复杂的漏洞。到项目结束时，团队确认他们能够控制这些主要地区的互联车辆。该成果凸显了在管理复杂的、面向互联网的汽车基础设施时所固有的巨大风险：身份提供方（Identity Provider）一处错误配置，或凭据摆放不当，都可能在大规模范围内导致物理资产被攻破。
The security research began with an investigation into a major automaker's connected vehicle platform, motivated by skepticism regarding the safety of modern internet-connected car systems. By decompiling the official Android application and examining API requests, the researchers identified a primary reliance on a suite of telematics subdomains. A critical vulnerability was uncovered in an admin tool subdomain, which, despite being internet-facing, contained hardcoded API keys within its JavaScript bundle. This discovery allowed for the enumeration of user accounts and sensitive information, including the ability to link a vehicle's number plate to a specific owner's subscriber GUID and email address.
While the admin tool provided significant data access, it did not grant direct control over vehicle functions. The researchers turned their focus to the automaker's central identity platform, which utilized ForgeRock's OpenIDM software. Through further examination of the application's JavaScript bundles, they discovered embedded admin credentials for this identity system. Although the automaker had implemented Web Application Firewall, or WAF, rules to protect the sensitive OpenIDM endpoints, the researchers discovered that these defenses were incomplete.
Overcoming the WAF required finding a specific path traversal vulnerability. While initial attempts were blocked by strict servlet routing, further automated testing identified a specific bypass, using a `/static%2f..%2fopenidm/` prefix that circumvented the firewall entirely. This allowed the researchers to access internal APIs that permitted them to overwrite user passwords for any account on the platform. With the ability to reset passwords, they successfully navigated the authentication flow to bypass multi-factor authentication, effectively gaining full control over user identity sessions.
Once they were able to mint valid consumer access tokens, the final step was to execute remote commands against the vehicles. By combining the retrieved subscriber GUIDs with the newly minted access tokens, the researchers were able to send commands to unlock doors or start engines remotely, all starting from nothing more than a vehicle's number plate. This complete attack chain successfully demonstrated that the security of these vehicles relied on a series of fragile and interconnected digital systems.
The research eventually expanded beyond the Australian market, demonstrating that similar, though more complex, vulnerabilities existed in the automaker's infrastructure serving the United States, Canada, and Europe. By the end of the project, the team confirmed they could control connected vehicles across these major regions. The effort highlights the significant risks inherent in managing complex, internet-facing automotive infrastructure, where a single misconfiguration in an identity provider or a misplaced set of credentials can lead to the compromise of physical assets on a massive scale.
348 comments • Comments Link
- 观察者确认展示车辆为 Toyota RAV4（尤其是 XA50 代），并指出了后视镜外形、大灯设计以及仪表盘几何结构等细节。
- 安全研究人员通常会刻意隐瞒受影响制造商的身份，以降低法律风险，尽管公众往往很想知道哪些系统存在漏洞。
- 车联网功能与 eCall 等强制性安全法规的捆绑越来越紧密，导致车主很难在不牺牲关键功能的前提下退出这类"便利"生态系统。
- "始终联网"汽车的兴起，折射出智能手机市场中用户自主权的持续丧失，包括数据被收集、缺乏可修复性以及对企业云服务的依赖等问题。
- 拆除蜂窝天线通常被认为比禁用某些复杂的软件模块更切实可行的断联方式，因为这些软件模块可能已经深度集成到车辆的基础运行之中。
- 现代 Web 设计实践常以臃肿的客户端 API 和更不可靠的身份验证安全性为特征，因此经常因引发在简单的老旧系统中本就较少见的漏洞而遭到批评。
- 虽然物理门锁和传统安全措施容易被熟练的攻击者绕过，但现代数字漏洞更具破坏性：它们可以被大规模利用，在不惊动车主的情况下影响整支车队。
- 企业往往把安全当作可选的成本中心，而非基本的业务需求，常常无视甚至敌视那些提供漏洞证据的研究人员，而不是把他们纳入安全运营体系。
- "对大多数公司而言专业安全投入难以实现"的观点被反驳：许多违规源自基础层面的失误，例如硬编码凭证或糟糕的 API 设计，这些问题通过标准的开发实践本可以预防。
- 在理论上，建立由政府强制推行的零件登记制度可以通过追踪组件来遏制汽车盗窃；但批评者认为这可能引发企业越权、出现远程"砖化"（remote bricking），并带来长期可修复性风险。
这场讨论反映出人们对车辆从机械资产转向依赖互联网服务的日益焦虑：在这种转变中，控制权越来越多掌握在制造商手里，而不是车主手中。反复出现的一个核心观点是，"Connected"架构天生就带来复杂性，进而形成不可持续的攻击面，这通常源于糟糕的基础编码标准，而不是缺乏专业知识。尽管有人认为这些风险可控、且其价值超过了现代功能带来的便利，仍有不少参与者表达了对旧款车辆的强烈偏好——把它们视为在强制监控与潜在远程破坏时代下，真正所有权的最后堡垒。 • Observers identified the vehicle in the demonstration as a Toyota RAV4 (specifically the XA50 generation), noting details like mirror shape, headlight design, and dashboard geometry.
• Security researchers often withhold the name of the affected manufacturer to mitigate legal risks, despite potential public interest in knowing which systems are vulnerable.
• Connected vehicle features are increasingly bundled with mandatory safety regulations like eCall, making it difficult for owners to opt out of the "convenience" ecosystem without losing critical functionality.
• The rise of "always-connected" cars mirrors the loss of user autonomy seen in the smartphone market, including issues like data harvesting, lack of repairability, and dependency on corporate cloud services.
• Removing cellular antennas is often cited as a more practical method for disconnecting a vehicle than disabling complex software modules, which may be integrated into essential car operations.
• Modern web design practices, characterized by bloated client-side APIs and poor authentication hygiene, are frequently criticized for creating vulnerabilities that were less prevalent in simpler legacy systems.
• While physical door locks and traditional security measures are prone to bypass by skilled attackers, modern digital exploits are more dangerous because they can be scaled to compromise an entire fleet without alerting owners.
• Companies often treat security as an optional cost center rather than an essential business requirement, frequently ignoring or antagonizing researchers who provide proof of vulnerabilities instead of integrating them into their security operations.
• The belief that professional security is unattainable for most firms is countered by the argument that many breaches result from basic failures, such as hardcoding credentials or poor API design, which are preventable with standard development practices.
• Establishing a government-mandated parts registry could theoretically curb car theft by tracking components, though critics argue this creates potential for corporate overreach, remote bricking, and long-term repairability risks.
The discussion reflects a growing anxiety regarding the transition of vehicles from mechanical assets into internet-dependent services, where control is increasingly held by manufacturers rather than owners. A recurring theme is that the inherent complexity of "connected" architecture creates an unsustainable security surface, often due to poor implementation of basic coding standards rather than a lack of specialized expertise. While some argue that these risks are manageable and outweighed by the convenience of modern features, many participants express a strong preference for older vehicles, viewing them as the last bastion of true ownership in an era of mandatory surveillance and potential remote compromise.