Hide Yo Keys, Hide Yo Car

### Connected Vehicles and the Expanding Mobile Attack Surface At 00:00, Aaron Guzman opens by exploring the intersection of modern automotive technology and consumer telematics. Major automobile manufacturers increasingly integrate cellular modems into vehicles, delegating critical operations—such as door unlocking, horn sounding, GPS tracking, and remote engine ignition—to consumer smartphone applications and cloud telematics portals. Guzman argues that while researchers have extensively examined CAN bus vulnerabilities, mobile API integrations represent a widely accessible, low-friction attack surface.

### Anatomy of Automotive Telematics Portals At 05:30 and 11:15, Guzman details his security audit of the Subaru Starlink telematics ecosystem and its supporting mobile application. He deconstructs the application architecture, which communicates with third-party telematics service providers via RESTful web APIs. By routing mobile app traffic through an intercepting HTTP proxy (Burp Suite), he analyzes JSON request payloads, authentication headers, session management, and API authorization checks.

### Exploiting Insecure Direct Object References (IDOR) At 18:14, the presentation details the discovery of severe authorization bypasses and Insecure Direct Object Reference (IDOR) vulnerabilities within the telematics API. Guzman shows that when issuing commands to locate or unlock a vehicle, the API trusted arbitrary client-supplied vehicle identification parameters without verifying whether the authenticated user was the registered vehicle owner. Furthermore, API response tokens and session credentials were improperly cached across client instances.

### Remote Vehicle Actuation and GPS Location Tracking At 24:30 and 29:45, Guzman demonstrates the practical real-world impact of these API vulnerabilities. An unprivileged attacker with knowledge of a target's VIN or account identifier could issue API requests to remotely locate a vehicle via GPS, unlock the doors, sound the panic horn, and remotely start the engine. Because these commands traverse cellular infrastructure directly to the vehicle's onboard telematics unit, attacks could be executed silently from anywhere in the world without physical proximity.

### Telematics API Hardening and Vendor Remediation Concluding between 31:40 and 34:50, Guzman reviews the responsible disclosure process with Subaru and their backend telematics vendors. He details the remediation steps implemented, including robust server-side authorization enforcement, short-lived session tokens, API rate-limiting, and eliminating sensitive data leakage in response headers. He emphasizes that automotive manufacturers must treat connected mobile APIs with the same rigorous defense-in-depth applied to powertrain safety controls.

(AI summary — Gemini 3.8 Flash)