How API Flaws Led to Admin Access to 1k+ USA Dealers & Control of Yr Car
Reveals critical API vulnerabilities in a major automotive dealer platform that allowed national admin account creation and remote vehicle command access.
Summary
Centralized Dealer Management Platforms
Automotive dealerships across the United States rely on centralized software platforms to manage inventory, service appointments, customer records, and connected vehicle features.
Discovering Broken Object Level Authorization Flaws
Eaton Zveare identified fundamental access control vulnerabilities in a leading automaker's dealer platform APIs. Unauthenticated parameter tampering allowed researchers to elevate privileges and create national administrative accounts.
Remote Vehicle Telematics Compromise
With national administrator access, researchers could query customer profiles, retrieve vehicle identification numbers (VINs), and transmit remote commands to lock, unlock, start, and track thousands of customer vehicles nationwide.
Lessons for Connected Automotive Ecosystems
Securing automotive dealer management portals demands strict API authentication, multi-factor authorization on administrative endpoints, and rigorous architectural reviews of third-party vendor platforms.
Related talks
Main Stage·35 min
Eaton Zveare · R Piyush
Reveals critical API authorization vulnerabilities in automotive dealer management systems that allowed national admin account creation and remote vehicle control.
App Sec Village·32 min
Paulo Silva · David Sopas
Vulnerability chaining and web application research uncovering flaws across eleven major automotive manufacturers.
Car Hacking Village·30 min
Mohammed Shine
Mohammed Shine uncovers broken access controls in Honda Connect APIs, allowing unauthorized attackers to remotely unlock doors, start engines, and honk horns.