From CTF to CVE: Finding Flaws in Hyundai Blue Link Telematics
Bill Hatzer shares how practicing mobile app proxying for a CTF uncovered an unauthenticated API vulnerability in Hyundai Blue Link telematics.
Summary
Transitioning from CTF Challenges to Real-World Research
While participating in defensive and offensive CTFs, practicing foundational techniques often leads researchers to discover real-world zero-day vulnerabilities.
Intercepting Mobile Telematics Traffic with Burp Suite
Bill Hatzer details setting up a mobile testing lab, bypassing certificate pinning on an Android phone, and intercepting Hyundai Blue Link API traffic.
Discovering the Telematics API Authorization Bypass
Hatzer demonstrates how flawed backend API endpoint validation allowed an attacker to query vehicle status and send remote telematics commands without valid session tokens.
Coordinated Disclosure and Vendor Remediation
The author reviews the coordinated disclosure timeline with Hyundai and provides developers with mobile API authentication hardening guidelines.
Related talks
Car Hacking Village·30 min
Mohammed Shine
Mohammed Shine uncovers broken access controls in Honda Connect APIs, allowing unauthorized attackers to remotely unlock doors, start engines, and honk horns.
Car Hacking Village·22 min
Eaton Zveare
Reveals critical API vulnerabilities in a major automotive dealer platform that allowed national admin account creation and remote vehicle command access.
Main Stage·41 min
Jmaxxz
Reveals how telematics API vulnerabilities allowed unauthorized remote unlocking, location tracking, and engine start of any vehicle in a major connected car fleet.