When the Scope Breaks: MQTT, HTTPS, and SMS

The study’s most important evidence appears when the same authenticated seed identity is tested against three different resource planes. This chapter compares what the evaluated backends allowed through MQTT, HTTPS, and SMS, and why the effects are not interchangeable. The comparison also shows how to read the reported counts and five-vehicle matrix without turning bounded observations into a claim about every connected vehicle.

The MQTT boundary: visibility that reached toward control

The researchers first established a session accepted as the seed vehicle and examined whether the MQTT broker enforced topic-scoped authorization. MQTT is useful for connected vehicles because a long-lived publish-and-subscribe session can carry telemetry and near-real-time commands. It is also a sharp test of namespace isolation: if topic names identify vehicles, the broker must ensure that the authenticated session can operate only within the namespace assigned to that identity.

Under the study’s bounded conditions, that isolation did not hold consistently. A wildcard subscription associated with the authenticated session exposed telemetry from outside the seed vehicle’s expected namespace. During a one-hour observation window and within a selected subset of topics, the researchers saw 574 distinct VINs. They also identified 18 topic families covering status, telemetry, and command-related message types.

The 574 figure is important precisely because it is limited. It is a strict empirical lower bound for what that session revealed under that topic subset and time window. It is not an estimate of the entire fleet, and it does not mean that every observed vehicle was controllable. The observation establishes that the session could see identifiers and message flows outside its intended vehicle scope. It does not, by itself, establish a successful command against every identifier that appeared.

The distinction between visibility and control is central. Telemetry flowing into a session shows that topic authorization failed to isolate data, but it does not prove that the same session could publish a valid command to every visible topic. The researchers therefore treated passive observation and state-changing control as separate measurements. The topic families made the exposed data semantically meaningful, while the controlled command tests supplied evidence about actuation on owned vehicles.

The control tests supplied a different kind of evidence. The researchers replaced the seed vehicle’s application-level target with identifiers associated with other vehicles and observed whether commands addressed to those namespaces were accepted. For OEM-A and OEM-C, the backend accepted cross-tenant command requests in the evaluated paths. The paper reports 100 successful unlock operations used to compare the script-based interaction with the official app; these state-changing tests were conducted only on vehicles legally owned by the research team.

The result was not uniformly successful on every connection attempt. For OEM-A, command success varied because the backend was served by broker clusters with inconsistent topic ACL deployment. Some clusters enforced the expected topic policy, while others did not.