Research by us has revealed direct CAN injection remote via APIs, which we intend to present the detail of live. Viper Alarms uses a back-end from CalAmp, the manufacturer of LoJack. We'll show how the LoJack vehicle tracking & recovery device could be compromised and recovery of a stolen vehicle prevented. This research lead us on to compromise of OEM-approved vehicle trackers and immobilisers. The rabbit hole went very deep indeed. This is a story of systemic compromise through weak platform providers and outsourced security.