When a connected car is sold, could the previous owner still find, unlock and start the vehicle? One IBM cybersecurity researcher thinks so.