A third party is draining your whole fleet through your own API — and every IP it shows you is a decoy.

“Third parties reverse-engineer our connected-car API, phish customers for their app logins, and pull whole-fleet data off the telematics backend with no agreement in place. We can't tell them from a real driver at the network layer — and when we try to block them, the IP is already gone. Solve this and you're in a very good niche.”

Concretely, and at the class level: the API they call is your app's API, because it is your app's protocol. A third party reverse-engineers the connected-car companion app until it holds the exact calls the official app makes, then authenticates the same ways your own app does — a phished owner login, a static API-key header lifted from the app bundle, or an OAuth bearer token that is portable to any IP. From there it is contract-less, long-lived polling: a request every few minutes, streams held open — indistinguishable from a real handset because it is the handset's protocol. This isn't theoretical: public reverse-engineered clients for a major European connected-car backend already circulate. The root cause has a name — OWASP broken authentication / BOLA: the token, key or password authenticates a claim, never the machine on the other end.

This is invisible by design: a legitimate driver is one IP to one car; the abuser is one operator to thousands, holding valid credentials and showing you a disposable address every few requests. Whole-fleet telematics resale is not hypothetical — two data brokers reached billions of harvested vehicle-data points, and litigation, before both collapsed in 2024. That makes it a GDPR and EU-Data-Act incident, not only a security one.

That identity already has a home on the network you run: an address. Here is how the car's own key becomes an address no one can forge.

Point it at the car. Derive each vehicle's — or each ECU's — /128 from the hardware key it already holds: the secure element, the TPM, the IEEE 802.1AR IDevID, with the VIN or ECU serial as the domain separator. The private key never leaves the secure element; the address is a one-way function of its public half and the VIN. The V2C backend then authorizes on the car's pinned identity, not a stealable token — no bespoke CA trust store to push to every vehicle, and revocation at DNS-TTL speed instead of CRL/OCSP soft-fail.

Maps to UN R155 (CSMS), R156 (SUMS), ISO/SAE 21434, the EU Data Act (in force since 12 Sep 2025 — verifiable per-party identity is how you draw the authorized-user-vs-unauthorized-aggregator line) and GDPR. Know, attribute and revoke every component — delivered as a network primitive, not a compliance binder.

# ask the graph the business-logic question directly — read-only Cypher over the public graph API
$ curl -s https://graph.whisper.security/api/query -H "X-API-Key: whisper_live_xxx" \
    -H 'content-type: application/json' -d '{"query":"MATCH (src)-[t:TOUCHED]->(v:VehicleIdentity)
    WHERE t.window = \"15m\" WITH src, count(DISTINCT v) AS vins
    WHERE vins > 50 RETURN src, vins ORDER BY vins DESC"}'
  operator <fingerprinted>   1 source → 3,412 distinct VINs / 15m
  egress:  AWS eu-central → GCP europe-w4 → Azure westeu   (collapsed to 1)
  ja4:     same tooling across 41 residential exits → 1 operator
  reproducible, replayable JSON evidence chain → your SIEM

The verbs your analysts run (or your agent runs for them): identify(ip) (who really operates a host, even behind a CDN) · origins(prefix) + walk(node,depth) (cluster rotating IPs into one genealogy) · history / watch (a timeline and a standing sentinel over a suspect operator). Every answer is reproducible, replayable JSON: the GDPR and EU-Data-Act paper trail for an unauthorized-aggregator finding, not a screenshot.

Identity is the cure; the graph is how you clean up what got in before it, and catch the operator who tries anyway. Detection made durable, on top of a root-cause fix.

See the full comparison →