Unlocking any car from X brand in most of the world

A security researcher, in collaboration with Sam Curry, investigated the security of a major automaker's connected car system and discovered that the system's API requests made to a domain (redacted-telematics.com.au) exposed sensitive information, including an admin tool (admintool.redacted-telematics.com.au) that could potentially be used to unlock any car from the brand. The researcher was able to decompile the app, reconstruct API requests, and identify the domain, which led to the discovery of the admin tool. The automaker's connected car system was found to have a complex infrastructure, with various environments (admin tools, staging, dev, QA) available on the public internet, potentially making it vulnerable to exploitation.