Security researchers say they uncovered a chain of vulnerabilities that allowed them to remotely unlock and start connected cars in Australia, beginning with a vehicle’s number plate.

Sydney researcher Shubham Shah and US-based Sam Curry identified weaknesses in the customer-account systems of an unnamed carmaker that sells two vehicle brands in Australia. The issues were fixed within about two hours of being reported, and no evidence of criminal exploitation was reported.

Shah, co-founder of Sydney security firm Assetnote, described their work together in July 2026 in his account of the Australian findings. Curry’s separate write-up detailed related security failures affecting two automakers in North America. Both accounts were published on 7 November 2026.

The Australian chain began with a public registration lookup, which provided a vehicle identification number, or VIN, from a number plate. The carmaker’s internal systems could then connect that VIN to the owner’s account and email address.

Examining the carmaker’s Android app led the researchers to an internal administration tool, where JavaScript files contained hard-coded keys and administrator credentials. Credentials apparently intended for a test environment also worked on the live ForgeRock OpenIDM system managing customer accounts for the connected-car platform.

The researchers also bypassed a web application firewall protecting administration functions. The resulting access exposed customer names, phone numbers, password and PIN hashes, and push-notification tokens.

They could reset a user’s password, bypass multi-factor authentication and obtain the access token used by the official vehicle app. That enabled commands including locking and unlocking doors, sounding the horn and starting the engine remotely.

“Once you have that auth token, it's pretty much game over,” Shah said.

Shah said all testing was conducted “on cars we explicitly owned or had permission to interact with.”

The North American investigation found exposed administration consoles on two automakers’ ForgeRock login servers that accepted default credentials. This allowed code to run on production identity servers and enabled account takeovers.

Accessible information included vehicle location, mileage, range, tyre pressures and door and window status, alongside remote vehicle commands. Curry said “we tested the complete chain only with US accounts and vehicles”, with testing conducted on a vehicle whose owner was present and consented.

The carmakers fixed the issues and rotated the affected credentials. Curry noted that ForgeRock’s own production-hardening guidance recommends removing or protecting the administration console.

Separate BYD Test Raised Cybersecurity Questions

In a separate case in September 2026, ABC’s Four Corners showed Canberra researcher Dan Hreszczuk of Fortify Labs remotely operating functions on a BYD Shark 6, including its door locks, screen, wipers, headlights and cabin microphone. The demonstration did not involve control of the brakes or steering.

BYD Australia said its investigation found Hreszczuk had used a software defect after gaining physical access to enable a debug mode and install a third-party app. The company disputed that the footage demonstrated a remote attack without physical access and announced an over-the-air fix.

Australia has no mandatory minimum cybersecurity standard for new cars.