Researchers trace a number plate to remote car unlock in automaker’s connected-car systems

Overview

Updated Yesterday

A security researcher working with Sam Curry found that a number plate could be turned into remote commands for an unnamed automaker’s cars in Australia. The chain ran through public registration data, a subscriber ID, admin credentials embedded in a vendor JavaScript file, and a web-firewall bypass.

The researchers then skipped multi-factor authentication and minted a consumer app token, which let them unlock doors and issue other commands. They tested only on cars they owned or had permission to access. Combined follow-up work covered vehicles in the United States and Canada.

Why it matters

A number plate was enough to reach remote unlock commands, showing how identity-system flaws can turn public vehicle data into physical access.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

Countries where combined write-ups demonstrated remote commands

Australia, the United States and Canada, according to the researchers.

Vehicle brands affected in the Australian environment

The automaker sells vehicles under two brands there.

Identifier needed to start the attack chain

A number plate led to a vehicle identification number through public registration lookups.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Shubs

Security researcher

Published the Australian attack-chain write-up

Sam Curry

Security researcher

Co-author of the connected-car research

Organizations Involved

The affected automaker

Automaker (unnamed)

Subject of the research; remediation not stated in the write-up

The unnamed manufacturer sells vehicles under two brands in Australia and operates connected-car services there, in the United States and in Canada.

ForgeRock

Identity software vendor

Its OpenIDM product was the identity store in the attack chain

ForgeRock makes identity-management software that the automaker used to manage customer accounts and vehicle access.

Timeline

July 2026 November 2026

3 events Latest: Yesterday

November 2026
Research reaches Hacker News
Latest Discussion

A Hacker News post links to the connected-car write-up.
Yesterday
Australian attack chain published
Disclosure

Shubs publishes the chain from number plate to remote unlock.
2 days ago
July 2026
Connected-car research begins
Investigation

Shubs and Sam Curry start examining the automaker’s connected-car identity systems.
July 2026

Scenarios

Automaker closes the exposed identity chain

Likely Resolves by Jan 31, 2027

Discussed by: Shubs and Sam Curry, whose write-ups describe the vulnerabilities

The researchers say they tested only on cars they owned or had permission to access. A fix would require removing hardcoded admin credentials, blocking the path traversal and closing the MFA skip. The write-up does not say whether those changes have happened.

Regulators open a connected-car security inquiry

Possible Resolves by Q2 2027

Discussed by: Security researchers and automotive cyber regulators

The chain crosses Australia, the United States and Canada, so transport or cyber regulators in those countries could ask the automaker for records. No regulator has publicly announced an inquiry in the write-up.

Researchers extend the chain to European vehicles

Unlikely Resolves by Q2 2027

Discussed by: Shubs and Curry, who note Europe’s identity environment was harder to breach

The Australian write-up says the US, Canadian and European OpenIDM environments were more hardened. A European demonstration would need a separate bypass.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

December 2022

Honda and Nissan connected-car flaw (2022)

Security researchers disclosed that connected-car APIs for Honda and Nissan allowed remote unlock, start and locate commands. The issues were reported as resolved.

Then

The companies addressed the reported API flaws.

Now

The case became a reference point for connected-car API security.

Why this matters now

It shows the same pattern: convenience apps and identity APIs become paths to physical vehicle control.

2022

Tesla Model X keyless-entry compromise (2022)

A paper in IACR Transactions on Cryptographic Hardware and Embedded Systems documented a practical security evaluation of the Tesla Model X keyless entry system, including the body control module and pairing protocol.

Then

The paper showed keyless entry could be studied at the protocol and hardware level.

Now

It reinforced that vehicle access security depends on both cryptography and implementation.

Why this matters now

The 2026 case moves the weak point from the key fob to the cloud identity platform.