API key exposure in redacted-telematics.com.au admin harness enabled VIN-based remote unlocks
A single exposed admin harness with static keys allowed full account and vehicle control once a plate yielded a VIN. The finding extends known telematics exposure patterns across multiple OEMs. Remediation requires removal of public admin tooling and mandatory per-request authentication.
The researcher decompiled the consumer Android application and mapped all traffic to *.redacted-telematics.com.au. The admin harness JavaScript bundle contained static credentials that granted access to account lookup, subscriber GUID resolution, and direct command issuance against production vehicles. No additional authentication or rate limiting was enforced on these paths.
Public Australian state registries convert number plates to VINs without authentication. The exposed /v1/account and command APIs then chained this identifier to subscriber email and remote unlock calls. The same infrastructure pattern appears in prior disclosures against other OEM telematics platforms where staging and admin subdomains remained internet-reachable.
Operational impact is immediate: any actor with a plate can locate the VIN, obtain the GUID, and issue unlock commands without owner consent or physical proximity. The vendor has not published a CVE or patch timeline. Fleet operators using the same telematics backend face identical exposure until the admin harness is removed from public DNS and all calls require per-session authorization.
Subsequent monitoring should track certificate transparency logs for new subdomains and test whether the same key material persists in updated APK builds after the July disclosure window.
Sources (2)
- [1]Primary Source(https://shubs.io/unlocking-any-car-from-x-brand-in-most-of-the-world/)
- [2]Related Disclosure(https://samcurry.net/connected-car-security/)