DEF CON 32 - Speed Bumps and Speed HacksP: Adventures in Car Mfg Security - Paulo Silva, David Sopas

A security assessment of nine car manufacturers reveals critical vulnerabilities in APIs, third-party software, and misconfigurations that can lead to data exfiltration and unauthorized access. The presentation demonstrates how chaining simple vulnerabilities—such as XSS, open redirects, and misconfigured AWS S3 buckets—can result in significant impact and prompt responsible disclosure.

Key Takeaways:
• Swagger UI XSS (3:27–4:26) enables attackers to inject malicious JSON payloads, leading to session hijacking and data theft; 3:27
• Outdated WordPress plugin with arbitrary file read (5:00–6:50) exposes database credentials and internal configurations; 5:00
• API cross-site scripting (9:00–11:35) allows retrieval of sensitive vehicle data (e.g., VIN, fuel levels) without user interaction; 9:00
• Open redirect and UI redressing (17:00–18:50) enables credential theft via phishing with malicious redirect URIs; 17:00
• S3 bucket subdomain takeover (22:00–23:10) allows attackers to create and control content after bucket deletion; 22:00
• Misconfigured Siteminder authentication (21:00–22:00) exposes XSS via user input, enabling token exfiltration; 21:00

Even common third-party tools and misconfigurations can be exploited to gain deep access to vehicle data, underscoring the need for regular audits, timely patching, and responsible disclosure.

Sources:

• 3:27 Swagger UI XSS vulnerability
• 5:00 Outdated WordPress plugin exploitation
• 9:00 API XSS