Remote Exploitation of Honda Connected Vehicles via Telematics APIs
Mohammed Shine uncovers broken access controls in Honda Connect APIs, allowing unauthorized attackers to remotely unlock doors, start engines, and honk horns.
Summary
The Expanding Attack Surface of Mobile Connected Car Apps
Modern vehicles increasingly integrate companion mobile applications that communicate with cloud backend servers to execute remote vehicle management commands.
Auditing Honda Connect API Endpoints
Mohammed Shine analyzes the REST APIs powering the Honda Connect mobile application for 5th generation Honda City vehicles, identifying broken object-level access controls.
Executing Remote Actions via Telematics Control Units (TCUs)
The author demonstrates manipulating API requests to send unauthorized commands directly to target vehicle TCUs—including locking/unlocking doors and remote engine starts.
Securing Connected Vehicle Cloud Backends
The presentation outlines crucial API security controls, token authorization checks, and mutual TLS validation required for automotive telematics backends.
Related talks
Car Hacking Village·22 min
Eaton Zveare
Reveals critical API vulnerabilities in a major automotive dealer platform that allowed national admin account creation and remote vehicle command access.
Car Hacking Village·36 min
Bill Hatzer
Bill Hatzer shares how practicing mobile app proxying for a CTF uncovered an unauthenticated API vulnerability in Hyundai Blue Link telematics.
Main Stage·35 min
Eaton Zveare · R Piyush
Reveals critical API authorization vulnerabilities in automotive dealer management systems that allowed national admin account creation and remote vehicle control.