3 ms·

So from what I gathered, they weren't running any validation on the server aside from that the VIN existed and matched a customer's vehicle? No JWT token/cookie

So from what I gathered, they weren't running any validation on the server aside from that the VIN existed and matched a customer's vehicle? No JWT token/cookie validating the logged in user or anything else?

Firmwarrior 4y ago
Pretty crazy if true The news is going to be saying "Security issue found, elite hackers elitely hacked into SiriusXM" when it should be saying "Sirius did not bother to implement any security at all for their remote management software"
bornfreddy 4y ago
Yup. And I wonder how they fixed it - did they actually find a way to distinguish the owner from the hackers? Does anyone know how the initial pairing with the app works?
- rglover 4y ago
  I mean the dirt simple way would be to authenticate the user's account, return some JWT/cookie, and then when you make requests to the API, pair that token w/ the VIN. If the VIN doesn't belong to that token (or the token itself is invalid), 403 it.
  - bornfreddy 4y ago
    Well yes, there are many ways this can be solved properly, but this doesn't mean they used any of those. P.S.: not that it matters, but - 401?
    - rglover 4y ago
      I'd use 403 for it. 401 is similar, but would apply more to "you typed in the wrong password" than "you tried to circumvent the security". The difference is narrow, though, and really it's just semantics so both would be valid IMO: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403
unqueued 4y ago
I was astonished when I noticed requests like this after I logged into a customer portal: curl 'https://hondalink.honda.com/api/VehicleFeatures/[VIN NUMBER]' -H 'hondaHeaderType.country_code: US' -H 'hondaHeaderType.language_code: en' -H 'Authorization: Basic [DIGEST]' -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Car-Type: HONDA' Not just are they using basic http auth, but it is silently ignored by the server. Try it yourself. They clearly intended to impelement authentication on their API endpoints, but didn't finish it, becuase the client is sending an Authorization header. But I don't know if their servers are even configured to check them. And they should certainly use JWT instead of digest.

Firmwarrior 4y ago

Pretty crazy if true The news is going to be saying "Security issue found, elite hackers elitely hacked into SiriusXM" when it should be saying "Sirius did not bother to implement any security at all for their remote management software"

bornfreddy 4y ago

Yup. And I wonder how they fixed it - did they actually find a way to distinguish the owner from the hackers? Does anyone know how the initial pairing with the app works?

rglover 4y ago
I mean the dirt simple way would be to authenticate the user's account, return some JWT/cookie, and then when you make requests to the API, pair that token w/ the VIN. If the VIN doesn't belong to that token (or the token itself is invalid), 403 it.
- bornfreddy 4y ago
  Well yes, there are many ways this can be solved properly, but this doesn't mean they used any of those. P.S.: not that it matters, but - 401?
  - rglover 4y ago
    I'd use 403 for it. 401 is similar, but would apply more to "you typed in the wrong password" than "you tried to circumvent the security". The difference is narrow, though, and really it's just semantics so both would be valid IMO: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403 https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403

unqueued 4y ago

I was astonished when I noticed requests like this after I logged into a customer portal: curl 'https://hondalink.honda.com/api/VehicleFeatures/[VIN NUMBER]' -H 'hondaHeaderType.country_code: US' -H 'hondaHeaderType.language_code: en' -H 'Authorization: Basic [DIGEST]' -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'Car-Type: HONDA' Not just are they using basic http auth, but it is silently ignored by the server. Try it yourself. They clearly intended to impelement authentication on their API endpoints, but didn't finish it, becuase the client is sending an Authorization header. But I don't know if their servers are even configured to check them. And they should certainly use JWT instead of digest.