Cloud-Native Carjacking: Fleet-wide Compromise via Telematics Authorization Failures

Modern connected vehicles increasingly rely on cloud-centric telematics backends to provide remote control, telemetry, media access, and other software-defined functionality. Although these platforms commonly employ endpoint hardening and encrypted communication, such measures do not ensure correct backend authorization. Across the platforms we evaluated, cloud services often accepted a valid vehicle identity without consistently binding that identity to the specific topic, object, or command target being accessed. We investigate this failure mode by recovering reusable authentication material from a seed vehicle and testing whether backend authorization remains properly scoped to vehicle-specific resources across MQTT, HTTPS, and SMS. On several legacy platforms, process-memory inspection exposed client certificates, private keys, tokens, or session artifacts sufficient to authenticate to backend services. Using this material, we established authenticated backend sessions and then modified logical vehicle identifiers, such as Vehicle Identification Numbers (VINs), at the application layer. We discovered previously unknown authorization vulnerabilities in telematics platforms used by three major OEMs. Starting from a single seed vehicle under the attacker's control, we demonstrate cross-vehicle privilege escalation without physical access to victim vehicles and without OEM-internal privileges. These flaws enable remote vehicle control, unauthorized access to private surveillance media, and spoofed fallback commands. We conclude with root-cause analysis informed by coordinated disclosure and derive mitigation lessons for identity-bound, Zero-Trust-style telematics authorization.