“Fully remote lock, unlock, engine start, engine stop, precision locate, flash headlights, and honk vehicles using only the VIN number”
The VIN sits on the dashboard behind the windshield. For Kia, Honda, Infiniti, Nissan and Acura, it was enough to start the engine, track the car and take over the owner’s account. Spireon’s SQL injection reached 15 million telematics units, and SiriusXM leaked AWS keys with full S3 access. The car companies sold remote start as a feature and secured it like a hobby project.