DEF CON 33 - How API flaws led to admin access to 1k+ USA dealers & control of yr car - Eaton Zveare

Optimized Summary (Final Version – Based on Raw Transcript & Feedback):

A critical, low-complexity vulnerability in a major automaker’s nationwide dealer management system—used by over 1,700 U.S. dealerships—allowed a single attacker to gain full national access to customer data, vehicle control, and internal operations. The flaw was one-line missing validation in an invite token check, enabling unauthorized account creation without proper verification.

How the Exploit Worked:

1. Bypassing Invite-Only Login:
   The system required a valid invite token for registration. Using CSS to force display of a hidden registration form, the attacker submitted it with a blank invite token—successfully creating a user account.

2. Exploiting Limited Session Profile Updates:
   A feature allowing limited profile edits (e.g., correcting name errors) was abused to establish a temporary session. This granted access to the backend JavaScript files and exposed an internal admin user creation endpoint.

3. Bypassing Frontend Protections:
   The attacker patched frontend logic—disabling error messages and redirect blocks—to avoid authentication prompts and gain access to the admin panel.

4. Creating a National Admin Account:
   By submitting a user creation request with full admin privileges (national, regional, sales, finance), the attacker successfully created a national admin account with complete access across all dealerships.

What the Attacker Could Do:

• Access PII and Financial Data:
  Retrieved names, addresses, phone numbers, driver’s license details, insurance info, and dates of birth from loaner car platforms and customer databases (over 650,000 survey entries).

• Remote Vehicle Control:
  Reassigned ownership of vehicles via a flawed enrollment process—effectively enabling remote start, engine control, and real-time tracking without notifying original owners.
  *Affected: