Grand Theft API

Grand Theft API

Speakers: Neiko (Specters) Rivera (Ex - Rivian Automotive Currently Red Teamer)

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=AWC66h81XdM

Overview

In the SAINTCON talk "Grand Theft API," Neiko Rivera, a seasoned bug bounty hunter and former Red Teamer at Rivian Automotive, exposes a series of critical vulnerabilities in the Application Programming Interfaces (APIs) of modern vehicles. Rivera details how fundamental security misconfigurations, primarily conflating authentication with authorization, allowed him and his collaborators to remotely control essential vehicle functions across multiple car manufacturers, including Hyundai, Genesis, Kia, and Nissan. This presentation serves as a stark warning about the nascent state of automotive cybersecurity, particularly concerning the burgeoning ecosystem of connected car services.

The talk delves into the nexus of API hacking and car hacking, demonstrating how seemingly innocuous web and mobile application flaws can translate into real-world physical threats, ranging from unlocking car doors and tracking movements to potentially enabling vehicle theft. Rivera's research, initiated during his tenure at Rivian and expanded through personal vehicle ownership, highlights a systemic problem within the automotive industry: a rapid adoption of interconnected technologies without commensurate security standards or thorough implementation of basic security principles.

The implications of Rivera's findings are profound, underscoring the severe risks consumers face when purchasing internet-connected vehicles. Since these vulnerabilities reside in the manufacturers' backend systems and APIs, consumers are largely powerless to mitigate them. The talk advocates for increased government oversight and a significant shift in how car companies approach software security, moving beyond superficial fixes to address the root causes of these critical authorization and authentication failures.

Background

▶ Watch: Introduction: Hacking cars and Rivian experience (0:00)

Neiko Rivera's journey into car hacking began informally between 2017 and 2019, participating in Defcon car hacking CTFs. This early exposure, despite self-professed lack of expertise, led to significant discoveries and eventually a role as a Red Teamer at Rivian Automotive. It was at Rivian that Rivera first uncovered a critical API exploit enabling remote control over vehicle movements, sparking his realization of the widespread nature of such vulnerabilities. This personal discovery, coupled with the purchase of a new Hyundai, catalyzed a deeper investigation into the security posture of automotive APIs.

A central theme of the talk revolves around the industry's widespread misunderstanding or misapplication of authentication and authorization. Rivera succinctly defines authentication as "who has the ability to log in" and authorization as "who should have admin access, who belongs to which group," emphasizing that car companies frequently confuse these two distinct security concepts. This confusion often leads to scenarios where an authenticated user, or even an unauthenticated attacker, can perform actions they are not authorized to do.

Rivera also touches upon the differing perceptions of vulnerability severity. While car manufacturers might classify an issue as a P1 (most critical) only if it affects all cars at scale, consumers view any compromise of their personal vehicle—the second most important purchase of their lives—as a P1 issue. Despite the existence of bug bounty programs and Vulnerability Disclosure Programs (VDPs) across many automotive companies, the persistent nature of these fundamental flaws indicates that current security practices are insufficient to protect consumers from sophisticated API-based attacks. The problem is exacerbated by the rapid pace of technological integration in vehicles, often outpacing the establishment of robust security standards.

Key Findings

▶ Watch: Car companies' vulnerability severity perspective and bug bounties (2:00)

Neiko Rivera's research uncovered a series of critical vulnerabilities across multiple car manufacturers, demonstrating a recurring pattern of insecure API design and implementation. These findings collectively paint a concerning picture of automotive cybersecurity:

1. Unauthenticated Vehicle Locking (Hyundai/Genesis - Initial Discovery): Rivera initially found an issue allowing him to lock any vehicle simply by knowing its VIN (Vehicle Identification Number), without any authentication token. While initially perceived as unauthenticated, further investigation revealed it was an authorization issue, where a generated PIN token could then be used by an attacker to unlock the car.
2. Account Takeover via Null Byte Injection (Hyundai/Genesis): A severe vulnerability was discovered in the consumer website's registration process. By appending a null character (%00) after the .com suffix in a victim's email address during attacker registration (e.g., [email protected]%00), the attacker could overwrite the victim's email information in the database. This allowed the attacker to perform a "vehicle takeover," gaining control over functions like unlocking, tracking, and starting/stopping the car via the app or website.
3. Kia Dealer Portal Authentication/Authorization Bypass (Initial): Rivera identified a dealer portal for Kia that lacked proper authentication. By analyzing JavaScript, he discovered a specific "pre-lo header" used for internal authentication. Combining this header with a missing "e-delivery" code allowed him to generate a link to the dealer portal, enabling him to log in and associate any vehicle with a customer account. This effectively bypassed the intended security mechanisms for vehicle enrollment.
4. Kia Dealer Portal Bypass (Two Years Later - Persistent Authorization Issue): Even after Kia implemented a fix by requiring authentication to the dealer portal, Rivera found the underlying authorization flaw remained. After logging in, the portal exposed specific tokens that could still be used to associate vehicles with a customer account, demonstrating that the fix only addressed authentication, not the deeper authorization problem.
5. License Plate to VIN Conversion: To overcome the challenge of obtaining VINs for targeted attacks, Rivera and his team leveraged "clever API tricks," some government-related, to convert a vehicle's license plate and state into its corresponding VIN. This significantly broadened the scope of potential targets, as VINs are not always publicly visible.
6. Nissan "Speedrun" Vehicle Takeover: A remarkably simple yet critical vulnerability was found in the Nissan mobile app. By proxying the app's requests and changing the accountSource parameter from customer to dealer during the vehicle enrollment process, Rivera gained full control over the targeted Nissan vehicle, including start, stop, location tracking, locking, and horn activation. This was described as the "simplest bug I've ever had to find."
7. Immobilizer Bypass: Rivera highlighted that some vehicles affected by these vulnerabilities lacked robust immobilizer systems. This meant that after remotely starting the engine and unlocking the car, it was possible to put the vehicle in drive and steal it, adding a physical theft dimension to the remote API compromise.

Technical Deep Dive

▶ Watch: Auth vs. AuthZ: Unauthenticated VIN-based car blocking (3:00)

The technical underpinnings of these vulnerabilities reveal a consistent pattern of flawed API design and insufficient security controls.

The Hyundai/Genesis account takeover hinged on a null byte injection vulnerability. When registering an account, the email field [email protected]%00 was processed in such a way that the null byte (%00) truncated the string stored in the database. This effectively allowed the attacker to register an account with a partially matching email address that would then overwrite or conflict with the legitimate victim's existing account. Once the attacker gained control of the victim's account through this method, they could then invite their own attacker account to the vehicle, thereby gaining full control. This control included critical functions such as remote engine start/stop, door lock/unlock, GPS tracking, and even updating the vehicle's PIN, which is often used for in-car authorization.

The initial Kia dealer portal bypass began with reconnaissance using tools like Hawky for reverse WHOIS lookups and Subfinder for subdomain enumeration. Rivera then focused on identifying dealer or admin portals by grep-ing for relevant keywords. Upon finding a suspicious dealer portal that appeared to auto-log him in, he dove into the JavaScript code using Chrome developer tools. He discovered a custom "pre-lo header" being used in API requests for authentication. By including this header in his own requests, he could bypass the initial authentication. However, full access required another piece of information: an "e-delivery" code, which he found by setting breakpoints in the JavaScript and tracing the data flow. Combining the pre-lo header with the e-delivery code allowed him to generate a specific link that granted him access to the dealer portal, enabling the unauthorized association of vehicles with arbitrary customer accounts.

Two years later, when Rivera re-evaluated the Kia system, he found that while authentication had been implemented for the dealer portal (requiring a login), the underlying authorization flaw persisted. After logging into the legitimate dealer portal, the system exposed two specific API tokens (likely session or authorization tokens) that could still be used to associate any vehicle with the logged-in user. This demonstrated a superficial fix that addressed the login requirement but failed to implement proper authorization checks on the API endpoints responsible for sensitive vehicle association operations. This highlights a common pitfall: adding authentication without sufficiently restricting what an authenticated user is authorized to do.

To streamline the attack chain for Kia, Rivera and his team developed a method to obtain a vehicle's VIN from its license plate. This involved leveraging "clever API tricks," some of which were "government-related." While the exact mechanism was not fully detailed, it allowed an attacker to input a license plate number and state and receive the corresponding VIN. This capability dramatically increased the attack surface, as attackers no longer needed physical proximity to read a VIN from a car window. With the VIN, the account takeover (using the previously discovered authorization bypass) could proceed remotely.

The Nissan "speedrun" vehicle takeover was arguably the simplest yet most impactful. By intercepting the Nissan mobile app's API requests using a proxy (e.g., Burp Suite), Rivera identified a parameter in the vehicle enrollment API call: accountSource: customer. By simply changing this parameter to accountSource: dealer, the API granted the attacker full "dealer-level" access to the vehicle. This included control over engine start/stop, location tracking, door lock/unlock, and even the car horn. The lack of server-side validation or authorization for this critical parameter allowed an attacker to elevate their privileges instantaneously, without any complex exploits. Rivera noted that Nissan has since moved to a GraphQL API, and the persistence of this specific vulnerability in the new API would require further investigation.

These technical details underscore a pervasive issue: a lack of rigorous input validation, insufficient server-side authorization checks, and an over-reliance on client-side controls or easily bypassed authentication mechanisms.

Demo / Proof of Concept

▶ Watch: Live POC: Unlocking car door via API exploit (5:15)

Neiko Rivera's talk was rich with practical demonstrations, showcasing the real-world impact of these API vulnerabilities.

For the Hyundai/Genesis vehicle takeover, the demonstration began with a video showing the process of registering a "victim" account (e.g., [email protected]) and then an "attacker" account. The key step involved the attacker appending a null byte (%00) to the victim's email during their registration, which, due to the null byte injection vulnerability, allowed the attacker to effectively take over the victim's account. Once the account was compromised, the video showed the attacker's ability to invite their own account to the victim's car. The interface then displayed a range of functionalities available to the attacker, including "start car," "stop car," "unlock my car," "lock doors," and "update the PIN." The demo specifically highlighted the ability to generate a PIN token and then use it to remotely unlock the presenter's personal car, which was visible in the video, confirming the physical impact of the digital exploit. Rivera also disturbingly mentioned that some of the affected vehicles lacked immobilizers, meaning that after remotely starting the engine and unlocking the car, it could be driven away. He demonstrated starting his own car's engine, emphasizing the potential for actual vehicle theft.

The initial Kia dealer portal bypass was demonstrated by Rivera setting off the car alarm on a Kia dealer lot. While the full technical steps of the bypass were explained earlier, the alarm activation served as a vivid, real-time proof of control over vehicles that were not his own. He noted that this level of access also granted capabilities such as viewing 360-degree cameras and enrolling bonus keys, expanding the scope of compromise beyond simple control.

The "embarrassing video" for Kia, created by Rivera and his collaborator Sam, showcased the license plate to VIN functionality and the subsequent account takeover. The video began by illustrating how an attacker could input a vehicle's license plate number and state into a custom application. This application, using "clever API tricks," would then fetch the corresponding VIN. The demo explicitly showed the VIN retrieval process. Following the VIN acquisition, the video proceeded to show Sam, the co-researcher, logging into the attacker's account and demonstrating the association of the newly identified vehicle. A log of commands appeared, culminating in the remote unlocking of the car doors. The researchers deliberately designed this demo to evoke the "Watch Dogs" video game, where characters hack cars via an app. Beyond unlocking doors, the demonstration also highlighted the ability to track the vehicle's location and retrieve up to 30 days of driving history, revealing sensitive personal movement data. The video concluded with the researchers remotely setting off the car alarm of the target vehicle.

For the Nissan "speedrun" vehicle takeover, Rivera humorously claimed a "very expensive special GT-R" via the API manipulation. While he did not physically demonstrate driving it away, he showed that he had the ability to lock and unlock it, underscoring the remote control achieved by simply changing the accountSource parameter. He stressed that most of these attacks, except for the initial one on his own Hyundai, were performed remotely, often by simply grabbing VINs from dealer websites, reinforcing the ease and scalability of the vulnerabilities.

Defensive Implications

▶ Watch: Immobilizer bypass: Potential for physical car theft (6:15)

The vulnerabilities exposed by Neiko Rivera underscore a critical need for fundamental shifts in how automotive manufacturers approach API security. Defenders, both within car companies and in the broader cybersecurity community, must implement robust strategies to mitigate these pervasive threats.

1. Strict Authentication vs. Authorization: The most crucial takeaway is to never confuse authentication with authorization. Every API endpoint, especially those controlling sensitive vehicle functions or user data, must enforce strict authorization checks in addition to authentication. It's not enough to know who is making a request; the system must also verify if that user is authorized to perform that specific action on that specific resource. This means implementing least privilege principles, ensuring that dealer accounts, for instance, cannot arbitrarily associate vehicles without multi-factor verification or strict business logic checks.
2. Robust Input Validation and Sanitization: To prevent attacks like null byte injection, all user inputs, particularly in registration forms and API parameters, must be rigorously validated and sanitized on the server-side. This includes checking for unexpected characters, length constraints, and data types, rejecting malformed inputs before they can interact with the database.
3. Comprehensive API Security Audits: Car manufacturers need to conduct continuous and thorough security audits of all their APIs, including those for consumer apps, dealer portals, and internal services. This involves penetration testing by independent security researchers, source code review, and implementing robust API Gateway protections. Special attention should be paid to parameters that can be easily manipulated, like accountSource, ensuring that server-side logic strictly controls their values and effects.
4. Secure Vehicle Enrollment Processes: The process of associating a vehicle with an owner or dealer account must be secured with multiple layers of verification. This could include physical key verification, multi-factor authentication for both the customer and the dealer, or time-limited, single-use tokens that expire quickly. The ability to associate vehicles based solely on a VIN or easily obtained tokens is an unacceptable risk.
5. Enhanced Immobilizer Systems: While API security is paramount, physical security measures like immobilizers should also be robust and immune to remote bypass. If a vehicle can be started and driven away via a remote API call, it indicates a critical failure in the vehicle's overall security architecture.
6. Consumer Protection and Disclosure: Manufacturers must recognize that consumers cannot fix these issues. They are entirely reliant on the manufacturer for software updates and security patches. Clear and transparent communication with consumers about security vulnerabilities and remediation efforts is essential, though often lacking.
7. Advocacy for Government Oversight and Standards: Rivera explicitly calls for more government oversight and the creation of industry-wide security standards for connected vehicles. Given the safety-critical nature of vehicles, relying solely on manufacturers' self-regulation has proven insufficient. Regulatory bodies should mandate minimum security requirements for automotive APIs and telematics systems.
8. Continuous Re-evaluation of Fixes: As demonstrated by the Kia "fix" that only addressed authentication but not authorization, security remediation is an ongoing process. Manufacturers must commit to continuously re-evaluating and re-testing previously patched vulnerabilities to ensure that fixes are comprehensive and not easily circumvented by slightly different attack vectors.

Key Takeaways

• API Security is Vehicle Security: The talk unequivocally demonstrates that vulnerabilities in web and mobile application APIs can directly translate into physical control and potential theft of modern vehicles, making API security a critical component of automotive safety.
• Authentication ≠ Authorization: A pervasive and dangerous flaw in automotive APIs is the failure to distinguish between who can log in (authentication) and what actions they are permitted to perform (authorization). This fundamental misunderstanding leads to critical security bypasses.
• Simple Parameter Manipulation Yields High Impact: Changing a single parameter, such as accountSource from customer to dealer (Nissan), or leveraging null byte injection in an email field (Hyundai/Genesis), can grant attackers full control over a vehicle.
• Remote Attacks are Scalable: Attackers can leverage publicly available information like VINs (from windows or dealer websites) and even convert license plates to VINs, enabling remote targeting and compromise of numerous vehicles without physical access.
• Consumers are Powerless; Manufacturers Must Act: Since these vulnerabilities reside in manufacturer-controlled backend systems, individual car owners cannot protect themselves. The responsibility for remediation lies solely with car manufacturers, who must prioritize comprehensive security over rapid feature deployment.
• Government Oversight and Standards are Needed: The current state of vehicle API security necessitates greater regulatory involvement and the establishment of industry-wide security standards to ensure consumer safety and prevent widespread compromise.

About the Speaker(s)

Neiko (Specters) Rivera is a prominent figure in the cybersecurity community, known for his expertise in bug bounty hunting and offensive security. He currently serves as a Principal Offensive Security Engineer at McDonald's. Prior to this role, Rivera was a Red Teamer at Rivian Automotive, where he gained firsthand experience with vehicle security and discovered some of the critical API vulnerabilities discussed in his talk. His journey into hacking cars began with participation in Defcon car hacking CTFs. Rivera also credits Iceman, Team Dumpster, Sikcon, Zad, ZLZ, and Sam for their significant contributions and support in his research and presentations.