How API flaws led to admin access to 1k+ USA dealers & control of yr car

How API flaws led to admin access to 1k+ USA dealers & control of yr car

Speakers: Eaton Zveare, Security Researcher

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=qNuS0rvqc8c

Overview

In an eye-opening presentation at DEF CON, security researcher Eaton Zveare unveiled a critical vulnerability chain that granted him national administrative access to the proprietary dealer system used by over a thousand automotive dealerships across the United States. This unprecedented access allowed Zveare to not only view extensive caches of sensitive Personal Identifiable Information (PII) for customers and employees but also, chillingly, remotely control vehicles by reassigning their ownership within the system. The talk highlighted how a series of seemingly minor API flaws, when chained together, could lead to a catastrophic compromise of an entire automotive ecosystem.

Zveare, known for his previous work on vulnerabilities in major automakers like Toyota, Honda, and Volvo, demonstrated that the digital infrastructure supporting the automotive industry, particularly legacy dealer systems, presents a vast and often overlooked attack surface. His findings underscore the profound security risks inherent in complex, interconnected systems that manage everything from vehicle orders and financing to customer data and remote car functionalities. The disclosure serves as a stark reminder of the importance of rigorous security testing and server-side validation in safeguarding critical infrastructure and consumer privacy.

The implications of this research are far-reaching, affecting potentially millions of car owners and dealership employees. The ability to silently take over vehicle control, access detailed financial records, and even cancel car deliveries illustrates the immense power that can be wielded through compromised dealer systems. Zveare's work emphasizes the urgent need for automakers and their third-party partners to re-evaluate their security postures, particularly concerning their APIs and the authentication mechanisms protecting their most sensitive data and functionalities.

Background

▶ Watch: Introduction: Hacking 1000+ US car dealerships (0:00)

Eaton Zveare's journey into the automotive security space began as a personal curiosity, observing the vast digital footprint of major automakers. He noted that large, established companies like Toyota often possess thousands of subdomains, presenting an expansive attack surface that can be rich with vulnerabilities. His preferred targets are Angular and React applications, prevalent in modern web development, because their client-side JavaScript bundles frequently expose critical information such as secret API keys, internal endpoints, and hidden administrative functionalities that can be reverse-engineered. This approach proved fruitful in his previous discoveries across various automakers and even in a McDonald's delivery service.

The specific target of this research was an unnamed automaker's proprietary dealer system, a cornerstone application used by virtually all of their over 1,000 dealerships in the US. This system is integral to daily operations, facilitating everything from customer car orders and tracking to sales reports and financial management. Given its critical role, the system was ostensibly secured with two-factor authentication (2FA) and featured an Angular-based frontend, albeit an "old" one. Access to the system was designed to be invite-only; new employees would receive a corporate email with an invite link to register their account. This invite link would contain a unique token, which the system was supposed to validate to permit registration. This established an initial perimeter of security, relying on the assumption that valid tokens were required for account creation, thus preventing unauthorized individuals from even initiating the registration process.

The existence of such a widespread, mission-critical system, often developed over many years and potentially incorporating legacy components, creates an inherent risk. These systems frequently evolve through piecemeal additions, leading to complex architectures where security oversight can be fragmented. The speaker's hypothesis, stemming from his experience, was that the sheer volume of code and the age of some components would likely expose weaknesses, particularly in how client-side applications interact with backend APIs and how permissions are enforced at a granular level. The challenge, as always, was to find the crack in the armor, starting from the seemingly locked-down frontend.

Key Findings

▶ Watch: Targeting the proprietary dealer system (2:00)

The central discovery was a multi-stage vulnerability chain that transformed a simple client-side observation into full national administrative control over a vast automotive dealer network. Zveare initially identified a hidden registration form within the system's HTML, which could be exposed using a basic CSS trick. Crucially, the system failed to adequately validate the invite token during account registration. By submitting a blank token, he was able to create an unverified, limited-privilege account.

This initial account, while largely useless on its own, provided a critical foothold. Zveare then leveraged a "profile update" feature to establish a limited session, granting him access to the full suite of backend JavaScript files. Within these files, he discovered internal admin management system functionalities, including user search and creation. Through clever frontend JavaScript patching – specifically, commenting out client-side error messages and replacing redirect logic – he bypassed client-side access controls, tricking the browser into loading the administrative interface.

This manipulation revealed a server-side bug that allowed his limited account to list existing users within the admin panel, despite lacking the necessary permissions. The ultimate breakthrough came with the discovery that the "create user" functionality was accessible and, critically, contained checkboxes for extensive permissions, including "national," "regional," and "admin, dealer, administrators." Exploiting this, Zveare successfully provisioned himself a national admin account, granting him unparalleled control over the entire system.

With national admin access, the implications were staggering. Zveare demonstrated the ability to:

• Retrieve comprehensive customer PII (name, address, phone number) by simply inputting a vehicle's VIN (Vehicle Identification Number).
• Perform a silent car remote control takeover for model year 2012 and newer vehicles. By reassigning a car's ownership to his own consumer account within the dealer system, he gained full remote control capabilities (engine start, real-time location tracking) via the mobile app, with the original owner remaining unaware if they had never registered for the service.
• Impersonate high-level employees, bypassing two-factor authentication (2FA) for systems inaccessible to the national admin account.
• Access a multitude of third-party systems, including loaner car platforms (exposing driver's licenses, insurance policies, dates of birth), employee Social Security Numbers (last four digits), inventory control (ordering/canceling cars), finance portals (balance sheets, KPIs, dealer rankings), lead management systems (hundreds of thousands of customer leads), and even customer survey data (over 650,000 entries) and demographic maps with data on 9 million people.
• Potentially launch sophisticated phishing campaigns using dealer email platforms and customer lists.

The disclosure timeline was remarkably swift, with the automaker fixing the core vulnerabilities within days of Zveare's report, showcasing a highly commendable and responsible approach to security.

Technical Deep Dive

▶ Watch: Bypassing registration to get a useless account (3:15)

The technical heart of this compromise lay in a series of chained API and client-side vulnerabilities, meticulously exploited by Zveare. The attack began with the observation of the initial login system. While the public-facing site required a provided ID and offered no public registration, the process for new employees involved an invite link with a unique invite token. This token was intended to gate access to the registration form.

Zveare's first discovery was that the actual registration form was not dynamically generated or fetched, but merely hidden in secret in the HTML of the login page. A simple CSS trick (e.g., manipulating display: none; or visibility: hidden; properties via browser developer tools) was sufficient to force its visibility. This alone was not a critical vulnerability, as the form still required the invite token. However, when attempting to submit the form, Zveare noted that the invite token was included as a field in the POST request body. Rather than providing a valid token, he submitted the form with a blank token. To his surprise, the backend API processed this request, successfully creating a new user account. This indicated a fundamental flaw in server-side validation: the backend API endpoint responsible for user registration failed to properly verify the presence or validity of the invite token before creating an account. This bypass was the critical first step in gaining unauthorized access.

The newly created account, however, was mostly useless, lacking any meaningful permissions and requiring a dealership admin's verification. This presented a temporary dead end. Zveare then discovered a "profile update" button. Interacting with this functionality established a limited session, indicated by a J session ID cookie. This session, while restricted, was crucial because it allowed the browser to fully load the main frontend application, including its entire JavaScript bundle files. Previously, without a valid session, these extensive files, which contained much of the application's logic and API endpoints, would not have been downloaded.

With access to the JavaScript bundles, Zveare began reverse-engineering the client-side code, looking for internal API endpoints and administrative functionalities. He identified URLs related to an "internal admin management system," specifically "user search system and creation functionality." Attempting to navigate directly to these URLs, however, resulted in client-side errors and redirects designed to prevent unauthorized access. The system would display messages like "your login dealer is invalid" and then log the user out, or redirect to an "access denied" page.

To overcome these client-side protections, Zveare performed frontend JavaScript patching. For the "login dealer is invalid" message, he located the relevant JavaScript code responsible for displaying it and logging out, and simply commented it out. For the "access denied" redirect, he identified the JavaScript function that initiated the redirect and replaced its functionality with an empty string, effectively making it a no-op. These client-side patches tricked the browser into thinking it had permission to access the admin page, allowing the frontend to attempt to load the content.

This client-side bypass led to the revelation of a server-side bug: despite his limited account's lack of permissions, the backend API for listing users in the admin panel returned actual user data. This indicated that while the frontend attempted to enforce access control, the backend endpoint itself was insecurely configured or lacked proper authorization checks for this specific query. More importantly, the loaded admin page contained a "create user" button. Clicking this button revealed a comprehensive user creation form, far more advanced than the initial public registration. This form included numerous checkboxes for various organizational roles and access rights, such as "national," "regional," "sales," "finance," and critically, "admin, dealer, administrators." Zveare selected all available options and submitted the form.

The submission was successful, resulting in the creation of a full national admin account. This account was provided with a new user ID and password via email. Upon logging in with these new credentials, Zveare was presented with a list of approximately 1,700 dealers to choose from, confirming the unprecedented scope of his access. This national admin account essentially had "root access" to every dealer in the system, bypassing all prior authentication and authorization layers through the cumulative effect of these chained vulnerabilities.

Further technical exploration revealed an internal user impersonation function. For any specific system that the national admin account could not directly access, Zveare could simply find a high-level employee within the system and take over their account in the backend. This impersonation bypassed two-factor authentication (2FA) mechanisms, as the impersonation happened at a deeper level than the user's login flow. This capability ensured that virtually no system connected to the dealer network was out of reach.

Demo / Proof of Concept

▶ Watch: Patching JavaScript to access admin panel (5:50)

Eaton Zveare provided two compelling real-world demonstrations of the capabilities afforded by his national admin access, though one was presented without video to protect the anonymity of the automaker.

The first demonstration involved customer PII disclosure. Zveare explained his process of finding a vulnerable car in a public parking lot, noting its VIN from the windshield. Back at his computer, he utilized a customer lookup tool within the admin panel. This tool allowed searching for customers by name or, crucially, by VIN. By simply plugging in the VIN, he was able to retrieve the car owner's full name, address, phone number, and other various pieces of personal information. This showcased how easily an attacker with this level of access could dox individuals based solely on their vehicle's publicly visible VIN.

The more impactful demonstration was the remote control takeover of a car. Zveare enlisted a friend who was willing to have his car remotely commandeered for the test. The process involved several steps:

1. Consumer Account Creation: Zveare first created his own consumer account within the system, similar to how a legitimate customer would.
2. Vehicle Reassignment: Using his national admin privileges, he navigated to his newly created consumer profile and selected "add vehicle." He then provided his friend's car's VIN.
3. Bypassing Verification: The system presented a series of bullet points that a salesperson is supposed to verify, such as confirming the person owns the car, the car is present, and their identity. Zveare explicitly stated that these were merely "pinky promises," as clicking "continue" did not prompt for any actual verification data (e.g., proof of ownership, ID scan). The system then asked for seemingly arbitrary data like odometer readings and driving habits before confirming the customer's address and name.
4. Successful Ownership Transfer: The system reported that the ownership assignment was successful, and Zveare's account now had ownership of the car.
5. Remote Control: Although a video could not be shown due to the potential to reveal the car brand, Zveare confirmed that he was able to log into the automaker's mobile app using his consumer account and gain full remote control functionality over his friend's vehicle. This included the ability to start the engine, track its real-time location, and essentially treat it "like my car." The car was subsequently transferred back to his friend without issue.

A critical nuance of this car takeover was the "silent takeover" scenario. Zveare highlighted that all cars from model year 2012 and newer are equipped with a 4G chip, constantly communicating with the automaker's servers, regardless of whether the owner has registered for the mobile app. If an owner had never registered their car with the mobile app, they would not have an associated email address in the system for notifications. In such a case, if an attacker performed a vehicle reassignment, the original owner would receive no email notification about their car being deactivated from an account they never set up. This would make the takeover entirely silent, with the attacker becoming the "first owner" of the car in the system's eyes, without the legitimate owner ever knowing.

Defensive Implications

▶ Watch: Creating a national dealer admin account (6:55)

The vulnerabilities uncovered by Eaton Zveare expose critical weaknesses in the security posture of complex, interconnected automotive dealer systems and offer invaluable lessons for defenders across all industries.

Firstly, the most fundamental implication is the absolute necessity of robust server-side validation for all inputs and API calls. The initial bypass of the invite token by submitting a blank value underscores a severe flaw where client-side expectations were not mirrored by backend enforcement. Every piece of data submitted to an API, especially for critical actions like user registration or vehicle ownership transfer, must be rigorously validated on the server, irrespective of any client-side checks. This includes verifying the format, presence, and authenticity of tokens, IDs, and permissions.

Secondly, the reliance on client-side security measures for access control is a dangerous anti-pattern. Zveare's ability to patch JavaScript in his browser to bypass error messages and redirects demonstrates that client-side logic can never be trusted for security. All authorization decisions, including whether a user can access a specific administrative interface or perform a privileged action, must be enforced at the backend API level. This principle of least privilege should be applied rigorously, ensuring that even if a limited session is obtained, it cannot trigger unauthorized backend functionalities.

Thirdly, the discovery of the "profile update" feature granting access to backend JavaScript bundles highlights the risks associated with over-exposing internal application logic and API endpoints. Organizations should minimize the amount of sensitive code and configuration data exposed to the client. Furthermore, comprehensive API security testing is crucial to identify endpoints that may return sensitive data or allow unauthorized actions even when not explicitly linked from the client-side UI.

Fourthly, the "pinky promise" verification for vehicle reassignment reveals a profound gap in identity and ownership verification processes. For high-impact actions like transferring vehicle ownership, robust multi-factor verification, potentially involving physical checks, documentation uploads, or secondary authentication channels, is indispensable. Relying on an unverified salesperson's affirmation in a digital system is an unacceptable risk.

Finally, the widespread access to PII, SSNs, financial data, and customer leads across numerous internal and third-party systems underscores the critical need for segmentation and granular access control. Even a national admin account should ideally not have unfettered access to all data across all systems. Implementing role-based access control (RBAC) with strict segregation of duties and auditing capabilities can limit the blast radius of a compromised high-privilege account. Regular security audits and penetration testing of both first-party and third-party integrations, especially those handling sensitive data, are also paramount. The automaker's prompt remediation, facilitated by a Vulnerability Disclosure Program (VDP), also emphasizes the value of such programs in fostering responsible security research and rapid response.

Key Takeaways

• Simple Flaws, Catastrophic Impact: A seemingly minor API flaw – the lack of server-side validation for an invite token – initiated a chain of vulnerabilities that led to complete national administrative control over a vast dealer network.
• Dealer Systems are High-Value Targets: Automotive dealer systems are far more powerful and interconnected than commonly perceived, holding extensive PII, financial data, and control over critical vehicle functions, making them prime targets for sophisticated attacks.
• Client-Side Security is Insufficient: Relying on client-side JavaScript to enforce access controls or hide functionalities is a dangerous practice; attackers can bypass these measures through simple browser-based patching.
• Robust Server-Side Validation is Paramount: All inputs, tokens, and authorization checks must be strictly enforced on the server-side to prevent unauthorized actions and data access.
• PII and Car Control Risks are Real: The ability to retrieve customer PII via VIN and perform silent remote car takeovers for modern vehicles highlights severe privacy and safety implications.
• Vulnerability Disclosure Programs are Essential: The automaker's swift response and remediation within days of the report underscore the critical importance of well-managed Vulnerability Disclosure Programs (VDPs) for rapid incident response and system improvement.

About the Speaker(s)

Eaton Zveare is a dedicated security researcher with a proven track record of identifying and responsibly disclosing significant vulnerabilities in major organizations. His work in the automotive sector began with discoveries in Toyota's systems, which garnered him initial recognition and led to his first professional security role. Since then, he has expanded his research to other prominent automakers, including Honda and Volvo, consistently demonstrating his expertise in uncovering complex security flaws. Beyond the automotive industry, Zveare has also identified and disclosed security issues in other large-scale services, such as McDonald's delivery platform. He is motivated by the challenge and enjoyment of exploring the vast attack surfaces presented by older, large companies with extensive web infrastructures, particularly focusing on Angular and React applications to uncover hidden API keys, endpoints, and administrative functionalities. Zveare maintains a blog where he shares his security findings and insights.