Hacking Cars: Why APIs are the Weakest Link
🚗 Hacking Major Car Companies and Exposing Vulnerabilities
✨ Dan Barahona talks with Sam Curry on his research that exposed several major car companies' API vulnerabilities.
All modern vehicles have APIs that may contain vulnerable endpoints as proven by researcher and Staff Security Engineer (Yuga Labs), Sam Curry.
Out on vacation, Sam and a few buddies were looking to escape their cybersecurity lives and find relaxation, but they could not help their curiosity. Surrounded by a bunch of electric scooters, the team got to work.
Find out in this video how Sam and his friends not only learned they could hack and manipulate the electric scooters, but also cars! Check out which vulnerabilities were found and how Sam came about this groundbreaking discovery!
▬▬▬▬▬▬▬▬▬ 💻 API Security 💻 ▬▬▬▬▬▬▬▬▬
APIs are the building blocks of modern software development, allowing developers to access and manipulate data from a variety of sources. API security is a critical aspect of API development, involving the use of security protocols and practices to protect APIs from unauthorized access, attacks, and data breaches.
▬▬▬▬▬▬▬▬▬ 📖 Chapters 📖 ▬▬▬▬▬▬▬▬▬
00:00 Introduction
01:50 About Sam Curry & His Research
05:50 From Scooters to Cars
07:17 Account Related Vulnerabilities
08:38 Weak Single-Sign On (SSO) Examples
09:05 Mercedes Benz
09:40 BMW & Rolls-Royce
10:30 Techniques & Tactics Used
14:10 Discovering Endpoints that Weren't Meant to be Discovered
16:08 Obfuscation & Not Hardcoding API Keys
17:25 ECUs (Electronic Control Units)
18:53 Spireon Vulnerability: Taking Over Vehicles Completely
22:18 Can a Hacker Cause Physical Harm?
25:02 OWASP API Security Top 10
26:20 APIsec University: API Security Fundamentals
26:54 The Response from the Car Companies
28:31 Car Companies with Great Security
29:33 Internal and External APIs
32:00 The "Gap" Within Security Teams
36:06 Do IoT APIs Behave Similar to Web APIs?
37:33 Motorcycle & Scooter Security?
38:39 Wrap Up
▬▬▬▬▬▬▬▬▬ ✨ Connect with us ✨ ▬▬▬▬▬▬▬▬▬
💥Sign up for APIsec University: https://www.apisecuniversity.com/
💬Twitter: / apisecu
👋LinkedIn: / apisec-university
Don't forget to 🔔 Like & Subscribe!
#cybersecurity #api #hacking