A Chinese GPS tracker with nearly half a million customers has security flaws that could let a hacker cut fuel to a car while it's running, researchers say.