Speed Bumps and Speed Hacks: Adventures in Car Mfg Security
Vulnerability chaining and web application research uncovering flaws across eleven major automotive manufacturers.
Summary
Application Security in Automotive Manufacturing
While automotive physical safety receives intense scrutiny, the web applications and backend portals operated by car manufacturers frequently suffer from classic security weaknesses. Research across eleven major car brands revealed widespread exposure of sensitive customer and corporate data.
Chaining Web Vulnerabilities
Attack demonstrations show how unpatched third-party software and traditional web vulnerabilities can be chained together to compromise manufacturer infrastructure and leak personal identifiable information (PII).
Responsible Disclosure Outcomes
Coordinated disclosure across multiple automotive enterprises highlights the value of formal vulnerability disclosure programs for remediating systemic supply chain and application flaws.
Related talks
App Sec Village·29 min
Ian Hickey
Exploits URL path handling differentials to turn trusted websites into malware delivery platforms using Relative Path File Injection.
Car Hacking Village·22 min
Eaton Zveare
Reveals critical API vulnerabilities in a major automotive dealer platform that allowed national admin account creation and remote vehicle command access.
Creator Stage·25 min
Whit Taylor
Uncovers client-side gadgets, race conditions, and business logic flaws hidden within referral and reward systems across major bug bounty programs.