Lojackd pwning car alarms vehicle trackers - DEF CON 27 Car Hacking Village

In this talk at the DEF CON 27 Car Hacking Village (TransportHax), Ken Munro exposes severe security vulnerabilities across major aftermarket vehicle alarms, GPS tracking units, and remote immobilizers. He begins at 03:00 by detailing how security assessments into companion mobile applications and cloud management APIs uncovered broken object-level authorization (BOLA) and insecure direct object references (IDOR), allowing unauthenticated attackers to hijack user accounts.

Ken demonstrates the physical hazards of these flaws at 09:00, showing how an attacker could track real-time GPS locations for millions of equipped vehicles worldwide, remotely unlock car doors, sound alarms, and even send cut-off commands to shut down vehicle engines while in transit. At 12:00, he explains how incomplete vendor remediations left entire geographic regions exposed, noting that European cloud endpoints remained unpatched long after initial alerts.

Addressing the vulnerability disclosure lifecycle at 15:00, Ken contrasts cooperative vendors who patched bugs within hours against defensive manufacturers who issued legal threats. He concludes at 18:00 by warning consumers and fleet managers about misleading industry safety certifications, arguing that physical security accreditations frequently fail to evaluate underlying API and cloud backend security. (AI summary — Gemini Flash)