When I cared, I found out that a lot of OBD-II dongles shipped with the same MAC, which gave you access to everything on a bunch of websites.
You can curse the storm, but the wind will come.
You can curse the storm, but the wind will come.
Was the website's security based on MAC, which presumably is supplied by the client? If so, I guess.. typical IoT.
Short story: buy one cheap dongle on Amazon, dump the MAC (00:11:22:AA:BB:CC IIRC; it's been 15 years since I cared) and you have auth to all of the apps everywhere.
Reminder: the Bluetooth logo comes, mostly, from self-certification.
https://www.google.com/search?client=firefox-b-d&q=permissio...
Internally they're all Bluetooth to serial chips, and another pic16xxxx chip which does serial to canbus.
I guess the Bluetooth serial chips probably have programmable Mac addresses, but equally they normally ship with a globally default one unless you flash a different one onto it.