Ken Munro - Lojackd pwning car alarms vehicle trackers - DEF CON 27 Car Hacking Village
Channel: DEFCONConference
Date: 2019-12-05

Research by us has revealed direct CAN injection remote via APIs, which we intend to present the detail of live.

Viper Alarms uses a back-end from CalAmp, the manufacturer of LoJack. We'll show how the LoJack vehicle tracking & recovery device could be compromised and recovery of a stolen vehicle prevented.

This research lead us on to compromise of OEM-approved vehicle trackers and immobilisers. The rabbit hole went very deep indeed.

This is a story of systemic compromise through weak platform providers and outsourced security.