This is a case study in why the misuse of identifiers can be a dangerous thing. Controlling vehicle features of Nissan LEAFs across the globe via vulnerable APIs.

Thankfully Nissan removed the app because someone could access a set of controls in the Leaf because the NissanConnect app only required the vehicle identification number (VIN) for access, which meant access was not restricted to a car’s owner, rather anyone that could guess a VIN (or read it off of a Leaf dashboard). Luckily the app allowed access to a limited set of controls outside of when the car was running.