DEF CON 23 showed how smart car security gaps scale

At a glance

What this is: This recap of DEF CON 23 highlights smart car hacking demonstrations that exposed weaknesses in keyless entry, vehicle command control, and GPS/location trust.

Why it matters: It matters because connected devices increasingly behave like identity-bearing systems, and IAM teams need to understand where authentication and trust assumptions fail at the edge.

Context

DEF CON 23 put smart automobile security under public scrutiny by showing how easily some vehicle controls and location signals can be manipulated. In plain terms, the article argues that the problem is not just software flaws, but trust assumptions embedded in device-to-device interactions.

For identity and access practitioners, the important takeaway is that these are identity-adjacent systems: keyless entry, remote commands, and navigation integrity all depend on reliable authentication and authorization boundaries. When those boundaries are weak, the device behaves as though access has already been granted.

The article’s examples are not presented as isolated curiosities. They illustrate a broader pattern that is typical of emerging connected-device environments, where security often trails capability and attackers exploit that gap early.

Key questions

Q: What breaks when keyless entry relies on a captured wireless signal?

A: The control breaks when a replayed or relayed signal is accepted as proof of legitimate presence. That turns proximity into a weak proxy for identity and lets an attacker unlock or interact with the device without owning the original key event. Freshness, anti-replay checks, and stronger device authentication are what prevent that failure.

Q: Why do connected devices need stronger command segmentation than traditional software systems?

A: Because one compromise path can expose multiple real-world functions if the device treats access too broadly. In connected cars, that can mean a foothold in one interface reaches power, lighting, or suspension controls. Segmenting command domains limits the blast radius when one interface is abused.

Q: How do security teams know if mapped telemetry is still trustworthy?

A: They know it is trustworthy when critical fields survive source updates, detection tests pass after schema changes, and confidence scores are reviewed before production use. If the same source repeatedly needs manual fixes, or if correlation outputs suddenly drop, the mapping layer is no longer reliable.

Q: What should organisations do first when device trust assumptions are too weak?

A: Start by identifying which controls still rely on convenience signals such as proximity, a single radio transmission, or one sensor source. Then rank those controls by business impact so the highest-risk access paths, command channels, and telemetry feeds are reworked first.

Technical breakdown

Why keyless entry systems fail under replay-style attacks

Keyless entry attacks work when a system accepts a signal as proof of proximity or ownership without ensuring the signal is fresh. In practice, replay and relaying techniques let an attacker capture and reuse a valid unlock signal, which bypasses the intended trust check. Rolljam-style devices make this practical because they reduce the attack to a small, inexpensive tool instead of specialised lab equipment. The technical weakness is not the lock mechanism alone, but the authentication model behind it. If the system cannot distinguish a live request from a captured one, it cannot reliably enforce access. Practical implication: design access decisions around freshness and anti-replay controls, not around signal possession alone.

Practical implication: enforce freshness and anti-replay controls for any wireless unlock or remote access flow.

How remote vehicle controls become a command-authorisation problem

The Tesla Model S examples in the article show that once researchers reached valid control paths, they could influence functions such as power state, headlights, interior lights, and suspension. That is an authorisation problem, not just a vulnerability problem: the system allowed commands to reach safety-relevant functions that should have been more tightly segmented. In identity terms, the car was treating operational access as broader than the task required. This is similar to overprivileged NHI access in enterprise systems, except the consequences are physical. Practical implication: separate command domains so that a compromise in one function does not automatically expose unrelated or safety-critical controls.

Practical implication: segment command domains so compromise of one function does not expose safety-critical controls.

Why GPS spoofing undermines device trust and telemetry integrity

GPS emulators can feed a device false location data, which means the problem is not only navigation error but corrupted trust in telemetry. When a connected system accepts location as authoritative without cross-checking it, downstream logic may behave incorrectly, from routing to safety decisions. The article’s GPS example shows how cheaply location integrity can be manipulated when the system trusts one signal source too much. For identity teams, the lesson is that trust is not limited to login events. Any sensor or signal that drives access, safety, or decision logic needs validation against other evidence sources. Practical implication: treat location and telemetry as security inputs, not just convenience data.

Practical implication: validate location and telemetry against more than one signal source before trusting downstream actions.

Threat narrative

Attacker objective: The attacker aims to bypass device trust boundaries and gain control over vehicle access, functions, or location integrity.

1. Entry occurs through cheap wireless interception or emulation that captures or forges a valid signal from the target device.
2. Credential access is achieved when the attacker reuses a legitimate-looking unlock or command signal without needing the original device owner.
3. Escalation follows when the attacker reaches broader vehicle controls or manipulates location data that influences system behaviour.
4. Impact is loss of physical and operational integrity, including unauthorized access, vehicle control changes, and false navigation data.

Breaches seen in the wild

• GitHub code signing certificate theft 2022: A machine account's compromised token cloned GitHub's Desktop and Atom repos, exposing encrypted signing certificates later revoked.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Smart car hacking is an identity problem, not only an embedded systems problem: The article shows that vehicles now depend on access decisions, command authorisation, and signal trust in the same way enterprise systems depend on identity assurance. When those trust checks are weak, the attack surface expands from entry to control to telemetry. That makes device identity design a governance issue, not just a product-security issue. Practitioners should treat connected devices as access-bearing systems with explicit trust boundaries.

Low-cost attack tooling changes the governance baseline: The Rolljam example matters because it compresses the effort needed to defeat a control that users assume is convenient and safe. Once a replay or relay attack can be done cheaply, the control can no longer be treated as an acceptable proxy for user presence. The implication is that security programmes must evaluate whether a mechanism remains defensible when attack cost drops below operational convenience.

Vehicle command surfaces need least-privilege segmentation: The Tesla demonstration shows how a single compromise path can expose unrelated functions when command interfaces are not isolated. That is the same overprivilege pattern seen in NHI estates, where one credential or token reaches more systems than it should. The result is an oversized identity blast radius. Practitioners should map which commands truly need shared trust and which should be fenced off.

Telemetry trust must be validated as rigorously as authentication: GPS spoofing shows that systems fail when they treat sensor input as inherently reliable. In connected environments, false location data can steer operational logic without ever touching a login screen. That creates a governance gap in which security teams focus on access while attackers target the inputs that influence downstream decisions. The practical conclusion is that telemetry deserves integrity controls, not just availability monitoring.

What this signals

Device trust is now part of identity governance: Connected products increasingly rely on access, command, and telemetry decisions that look like IAM problems even when they sit inside hardware or embedded software. Programmes that ignore those boundaries will miss the place where attackers actually bypass trust.

Identity blast radius is the right lens for smart devices: The central question is no longer whether a device can be accessed, but how far that access reaches once it is obtained. If a single control path can change power, lights, suspension, or location data, the governance model has already failed the least-privilege test.

For practitioners

• Harden wireless entry against replay Review keyless entry and similar proximity-based controls for replay and relay exposure, then require freshness checks that reject captured signals. Do not assume possession of a radio transmission proves legitimate access.
• Segment safety-critical command paths Map vehicle or device control surfaces into separate privilege domains so that compromise of one function does not automatically expose unrelated commands such as power, lighting, or suspension.
• Treat location as a security input Validate GPS and other telemetry against secondary signals before allowing them to drive navigation, safety logic, or automated decisions.
• Review trust assumptions in connected-device design Use this kind of demonstration to challenge where your programme still treats convenience features as if they were equivalent to authenticated access controls.

Key takeaways

• Smart car hacking demonstrates that convenience-oriented trust models can fail when wireless access, command control, and sensor integrity are not independently governed.
• The article’s examples show a progression from inexpensive lock attacks to deeper vehicle control and false location data, which is why blast radius matters.
• Teams responsible for IAM, PAM, and connected-device security should treat proximity signals, command domains, and telemetry as separate control problems.

Key terms

• Replay Attack: An attack where a previously valid signed message is captured and sent again later to trigger the same trusted action. Timestamping, nonces, and context binding are the main controls that reduce replay risk in HMAC-based systems.
• Command Segmentation: Command segmentation splits a device’s control surface into distinct privilege domains so one compromise does not unlock everything. For connected cars and IoT systems, this limits how far an attacker can move from one accessed function to another.
• Telemetry integrity: Telemetry integrity is the confidence that logs, metrics, and traces accurately reflect what happened. If an attacker can alter, redirect, or suppress telemetry, the security team may still see data, but it can no longer trust that data for investigation, detection, or compliance evidence.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.