DEF CON 33 - How a vuln in dealer software could've unlocked your car - E Zveare, R Piyush
Source: YouTube · DEFCONConference · published Oct 10, 2025 · 35:23
Ethan Zir discovered a vulnerability in automotive dealer software that allowed him to take over an entire ecosystem of over 1,000 dealerships 0:36.
Key Takeaways:
• He found a security flaw in the dealer invite system that let him create unauthorized admin accounts 3:18
• With admin access, he could look up customer personal information using just a VIN number 12:37
• He demonstrated transferring vehicle ownership to his account, allowing remote control of any car 15:55
• The vulnerability provided access to sensitive data including loaner agreements with driver's license information 23:00
• He gained access to connected systems including finance portals, inventory management, and customer survey data 27:03
The exploit was caused by just two simple vulnerabilities that were quickly fixed after responsible disclosure 34:36.
Sources:
- 0:36 Speaker introduces the vulnerability scale
- 3:18 Details about the dealer software hack
- 12:37 Looking up customer information via VIN
- 15:55 Vehicle ownership transfer demonstration
- 23:00 Access to loaner car system with PII
- 27:03 Access to connected systems and data
- 34:36 Conclusion about vulnerability causes and fixes
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[Applause] Um so yeah so the talk today is called unexpected connections. Um speaker's named Eaton. Um and you know it's going to be a really interesting talk. Hopefully you guys don't do this off the con but uh sounds very interesting and he'll explain to you what he's talking about. Here you go. Thank you so much. >> All right. Thank you all so much for attending. My name is Ethan Zir and my talk today is called unexpected connections. how a vulnerability and obscure dealer software could unlock your car from anywhere. But in a way that actually kind of undersells what actually happened. In reality, what I really did was basically take over an entire automotive ecosystem composed of more than a thousand dealers. And unlocking your car was really just the tip of the iceberg as to what I c…