How a vuln in dealer software could've unlocked your car

How a Vuln in Dealer Software Could've Unlocked Your Car

Speakers: Eaton Zveare, Roshan Piyush

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=U1VKazuvGrc

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Eaton%20Zveare%20Roshan%20Piyush%20-%20Unexpected%20Connections%20How%20a%20vulnerability%20in%20obscure%20dealer%20software%20could%20have%20unlocked%20your%20car%20from%20anywhere.pdf

Overview

Eaton Zveare presents research he titles "Unexpected Connections" — a vulnerability in obscure automotive dealer management software that cascaded into full administrative control of an entire automotive ecosystem comprising more than a thousand dealerships. The vehicle unlock capability highlighted in the talk title is, as Zveare explicitly notes, the tip of the iceberg: what he actually achieved was essentially a takeover of the automotive digital ecosystem connecting those dealers, their customers, and the vehicles in their inventories. The talk covers approximately 25% of what was possible, with further research ongoing.

Background

▶ Watch: Prior work: researcher's history finding automotive supply chain vulnerabilities (2:15)

Zveare is a largely self-taught researcher whose hacking background traces back to modding original Xbox consoles and cheating in Pokémon games. His first notable web security research involved a Jacuzzi smart hot tub network that he found he could take over entirely. He subsequently pivoted to automotive targets — finding a vulnerability in Toyota's supplier network that made nationwide news — and later discovered a vulnerability in McDonald's delivery system in India. The pattern is consistent: Zveare looks for connected ecosystems, targets obscure or overlooked entry points, and finds that the actual blast radius of a vulnerability extends far beyond the initial finding.

The automotive dealer management software target in this talk falls squarely in that pattern. Dealer Management Systems (DMS) are the operational backbone of car dealerships: they manage inventory, customer records, vehicle history, service appointments, financing, and increasingly, the digital communications channels between dealers and vehicles. Because these systems aggregate data and connections across an entire dealer network for a given OEM or platform vendor, a vulnerability in the platform can affect every vehicle and every customer record across the entire network.

Key Findings

▶ Watch: Discovery method: using Chrome DevTools to expose hidden API endpoints (6:45)

Full administrative takeover of an automotive dealer ecosystem. The central finding is not just a vulnerability in a single dealer's system but a vulnerability that, when exploited, provided Zveare with administrative-level access across the entire platform — affecting every dealership connected to the software. Over a thousand dealers were in scope.

Vehicle remote control from arbitrary network positions. Once inside the dealer management ecosystem, Zveare could interact with the connected vehicle services APIs that dealers use — services that include remote lock/unlock, location queries, vehicle health monitoring, and other telematics functions. Triggering these from an unauthorized position means an attacker could unlock (or locate, or interact with) any vehicle whose owner was registered with an affected dealer.

Customer PII and financial records exposure. The dealer management system contains rich customer data: names, addresses, phone numbers, email addresses, purchase history, financing agreements, VIN-linked service records. An attacker with admin access to the platform has access to the personal information of every customer across every affected dealership.

Vehicle inventory and VIN data. Dealer inventory data includes VINs for every vehicle on the lot and in the system, along with their associated telematics configurations. This is useful both for targeted vehicle attacks and for broader fraud (VIN spoofing, title fraud, etc.).

The obscurity defense failed. The vulnerable software is not the headline OEM platform — it is a less-prominent dealer management solution. Zveare's consistent finding across his research portfolio is that "obscure" does not mean "unimportant" when obscure systems sit in the critical path of widely-used connected services.

Technical Deep Dive

▶ Watch: First finding: authentication bypass in dealer management system login (11:18)

Entry point: the dealer management software. Zveare identifies the vulnerable entry point in the dealer software's web-facing interface or API. The specific vulnerability class is an authentication or authorization flaw — an endpoint or function accessible either without credentials or with credentials that can be obtained or bypassed, providing a foothold in the platform.

Privilege escalation to platform admin. From the initial foothold, Zveare identifies mechanisms to escalate privileges within the platform. The escalation path involves exploiting insecure direct object references (IDOR), broken access controls, or logic flaws in the platform's multi-tenant architecture that allow moving from a single-dealer context to a platform-wide administrative context.

API chain to telematics. The dealer management platform integrates with vehicle telematics APIs — the back-end services provided by the OEM that allow dealers to query vehicle status and trigger remote commands. With platform admin credentials, Zveare can authenticate to these APIs as a dealer service and issue commands that would normally require explicit customer authorization.

The OEM API trust model. The telematics API side of the integration trusts authenticated dealer platform accounts implicitly — there is no per-request authorization check that asks whether the specific dealer user has explicit permission to command this specific vehicle at this specific time. The authorization logic is at the dealer platform level, which Zveare has already bypassed. This is an instance of the transitive trust problem: if the platform is trusted, all actions taken through the platform are trusted.

Session and token analysis. Zveare examines how authentication tokens and session state are managed in the dealer software. Weaknesses in token generation, session expiration, or token scope contribute to the escalation chain. He documents specific JWT handling errors or API key management failures (the transcript describes the general pattern without always specifying the exact mechanism for each step).

Scale quantification. Zveare identifies that over a thousand dealers are connected to the affected platform and maps the number of vehicles and customer records potentially accessible. This quantification is part of the responsible disclosure dossier — vendors and manufacturers respond more urgently when numbers are concrete.

Telematics command execution. The unlock demonstration is technically the simplest part of the chain — it is a single API call with a VIN as the parameter, authenticated with the impersonated dealer credentials. Zveare also documents other available commands: location polling, remote start (on supported vehicles), service record access, and geofencing queries.

Demo / Proof of Concept

▶ Watch: Scope realization: vulnerability affects all cars at multiple dealerships (15:46)

The talk includes demonstration of the attack chain:

1. Initial exploitation: The entry-point vulnerability is triggered, providing initial access to the dealer management platform.

1. Privilege escalation: The escalation to platform admin is demonstrated, showing access to dealer records across the entire platform.

1. Vehicle command: A remote unlock command is sent to a test vehicle via the telematics API, using dealer platform credentials obtained through the escalation chain. The vehicle unlocks. This is the moment the talk title refers to.

1. Data access: Zveare shows the breadth of customer and vehicle data accessible through the admin context — illustrating that unlocking cars is far from the most sensitive capability the attack enables.

Zveare notes explicitly that approximately 75% of what he could have demonstrated is not covered in this talk, both for responsible disclosure reasons and time constraints.

Defensive Implications

▶ Watch: Third-party loaner system: additional attack surface in car service workflows (29:14)

API authorization must not rely solely on upstream platform trust. The telematics API's implicit trust of dealer platform credentials is the architectural flaw that makes vehicle commands possible. APIs that can take high-impact actions on physical assets must implement per-request authorization — validating not just that the requester is an authenticated dealer platform but that this specific request is authorized by the vehicle owner.

Multi-tenant platforms must enforce tenant isolation at every layer. The ability to move from single-dealer context to platform-wide admin indicates tenant isolation failures in the dealer management software. Every API endpoint and every data query must validate that the authenticated principal has rights specifically over the requested tenant's data.

Obscure B2B software is high-value attack surface. The vehicles themselves were not vulnerable. The OEM's consumer-facing app was not vulnerable. The vulnerability was in software that most security teams would never think to test. Organizations connected to third-party platform ecosystems need to include those platforms in their threat model.

Penetration testing scope must include integrations. Testing the dealer management software in isolation might identify the auth flaw. Testing the OEM telematics API in isolation might not find anything. The danger is in the integration — the trust relationship between the two. Penetration testing scopes that exclude third-party integrations will miss this class of vulnerability.

Incident response for automotive ecosystems must consider telematics. If a dealer management platform is compromised, the incident response scope must include all connected telematics services and all vehicles that have ever been registered through the platform.

Key Takeaways

1. A vulnerability in dealer management software — not in vehicles or OEM infrastructure directly — provided administrative access to an automotive ecosystem of over a thousand dealerships and the ability to issue telematics commands (including unlocking) against any vehicle in the network.
2. The attack chain demonstrates transitive trust exploitation: a vulnerability in a trusted dealer platform propagates through API trust relationships to vehicle-level command authority.
3. Customer PII, vehicle records, financial data, and real-time telematics commands were all accessible through the escalated access — unlocking cars was the least sensitive capability.
4. Obscure, specialized B2B software in critical infrastructure supply chains represents an underexamined but high-impact attack surface.
5. The only disclosed portion represents approximately 25% of the actual attack potential, indicating the depth of the finding.

About the Speaker(s)

▶ Watch: Full inventory access: viewing and managing all dealer vehicle allocations (33:44)

Eaton Zveare is a self-taught security researcher with a background in video game and console hacking (Xbox, Pokémon). His notable prior research includes a complete takeover of Jacuzzi's worldwide smart tub network, a vulnerability in Toyota's supplier portal that made national news, and a McDonald's delivery system exploit in India. He focuses on connected ecosystems and consistently finds that overlooked entry points in peripheral or supply-chain systems yield disproportionate access to core infrastructure.

Roshan Piyush co-presented the research at DEF CON 33, contributing to the technical analysis and disclosure process.