Reposting my comment from netsec. I'm not sure why Troy can't just refer to others public research directly instead of repackaging it and using "responsible di

Reposting my comment from netsec. I'm not sure why Troy can't just refer to others public research directly instead of repackaging it and using "responsible disclosure" as a cover for not sharing his (public) sources. It seems sketchy at best, dishonest at worst. >A GitHub repository documenting the API including the observation that “All other operations take the DCMID and the VIN of your vehicle as parameters for authorizing the requested operation” (although the DCMID value is not actually required and is empty in many of the examples above) https://gist.github.com/joshperry/15eadc2a63b22632d6ae https://gist.github.com/joshperry/15eadc2a63b22632d6ae >Another GitHub repository, this time a Python script to connect to and manage vehicle features via the API (also includes region codes for managing vehicles in other parts of the world) https://github.com/jdhorne/pycarwings2 https://github.com/jdhorne/pycarwings2 >Yet another GitHub repository built to target an earlier generation of the service and referenced as inspiration for the previously mentioned project probably https://github.com/haykinson/pycarwings https://github.com/haykinson/pycarwings >A blog post on reverse engineering the API which observes that “curiously, it seems like you just need the constant DCMID and VIN fields” (again, the DCMID parameter wasn’t actually used in our tests) http://virantha.com/2016/01/12/reverse-engineering-nissan-connect-ev-protocol/ http://virantha.com/2016/01/12/reverse-engineering-nissan-co... >A forum post on integrating the data into Domoticz (a home automation system) which makes this observation: “No other authentication necessary!” http://www.domoticz.com/forum/posting.php?mode=quote&f=31&p=74015&sid=da7f9475540847278474d2dd29baf039 http://www.domoticz.com/forum/posting.php?mode=quote&f=31&p=... IMO, his behaviour is straight up despicable. This stuff isn't hard to find, but he still refuses to give proper credit because of "responsible disclosure". Yet, anyone interested in attacking the API can and will find this stuff on google. Also, another example of Troy BS: https://twitter.com/troyhunt/status/701733562253336576 https://twitter.com/troyhunt/status/701733562253336576 Trying to publicly shame vkontakte for a nonexistent SQLi (this is a wiki page that anyone can edit, here's a wikipedia example demonstrating the same "vulnerability" https://en.wikipedia.org/w/index.php?title=%27&diff=706317017&oldid=646978585 https://en.wikipedia.org/w/index.php?title=%27&diff=70631701...)