Issue 212: Remote control of vehicles, API hacking for QA teams, API Top 10 walkthrough
Brief
This week, we have news of a critical API vulnerability that allowed a researcher to demonstrate a proof of concept attack allowing remote vehicle takeover. We have articles on three reasons why QA teams should learn API hacking and the new changes GitHub has made to API versioning to future-proof client code. Finally, we have a great walkthrough of the OWASP API Security Top 10 using the vAPI vulnerable application.
Vulnerability: Critical API vulnerability allows remote control of Hyundai and Genesis vehicles
First up is the excellent research from Sam Curry into an API vulnerability affecting the Hyundai and Genesis vehicle range. Curry created a proof of concept detailing the exploit and described the steps in detail on this Twitter thread. Most worryingly, the proof of concept demonstrated how the vehicle engine could be controlled remotely.