Issue 145: APIs and electric car charging stations, The Nuts and Bolts of OAuth 2.0
Brief
This week, we take a look at the recently discovered (and fixed) API vulnerabilities in electric car charging stations, a Udemy course on OAuth 2.0, the recently released Gartner Hype Cycle on APIs, and how APIs in microservices architectures can be exploited if they construct backend calls without properly validating inputs.
Vulnerability: Electric vehicle charging stations
Researchers at Pen Test Partners looked into the security of several popular smart charging stations for electric vehicles .
The chargers are typically controlled through a cloud platform and a mobile app, and hence have APIs that can be accessed remotely and can be vulnerable.
The potential exploits that Pen Test Partners found were threefold:
- Attackers might be able to retrieve users’ personal details.
- Attackers might be able to control the charging process for an individual car.