Is the Automotive
Industry Preparedto Navigate API
Security Risks in
Software-Defined
Vehicles?

Learn more about VicOne
by visiting VicOne.com orscanning this QR code:In today’s automotive ecosystem, application programming interfaces (APIs) have become both
ubiquitous and indispensable. Connecting various internal systems within vehicles, APIs arewidely applied across multiple scenarios. These include remote vehicle activation, connection
with third-party service providers for emergency assistance services, and energy management,
among many other applications. Service clouds between automotive manufacturers (OEMs) andsuppliers also heavily rely on APIs to facilitate rapid updating of software-defined vehicles (SDVs)
to enable cloud-native technologies.
Indeed, APIs are pervasive throughout the modern automotive ecosystem, encompassing cloudbased APIs, cloud-to-vehicle APIs, mobile-to-vehicle APIs, mobile-to-cloud-to-vehicle APIs, andin-vehicle APIs. These diverse types of APIs play pivotal roles, ensuring seamless connectivity andefficient operations across the entire automotive industry.

Third-party consumers and data brokers

11

Tier 1/2 suppliers

OEM

1

1

4

Tier 1/2 supplier cloud

User mobile app

OEM cloud

3

2

2

5

Connected vehicle

1

Cloud-based APIs

2

Cloud-to-vehicle APIs

3

Mobile-to-vehicle APIs

4

Mobile-to-cloud-to-vehicle APIs

5

In-vehicle APIs

Figure 1. Interconnectivity within the automotive ecosystem made possible by APIs

The Automotive API Attack LandscapeAccording to our findings in the VicOne Automotive Cyberthreat Landscape Report 2023, despite
the numerous benefits that APIs offered, incidents related to applications and APIs accounted
for 12% of the automotive cyberattacks and security incidents from the second half of 2022 to
the first half of 2023.
Our automotive threat intelligence database reveals that from 2020 to 2022, API attacks evolved
from targeting individual components to adopting a comprehensive strategy encompassing
the entire ecosystem. This shift in API attacks highlights a greater challenge to automotive
ecosystem security, indicating that concentrating solely on protecting individual APIs is no longer
adequate.
Is the Automotive Industry Prepared to Navigate
API Security Risks in Software-Defined Vehicles?

2API attacks in 2020

API attacks in 2021

API attacks in 2022

Cloud-based
API attack

OEM/Fleet cloud

Mobile-to-cloudvehicle API attack

Cloud-based
API attack

OEM/Fleet cloud

OEM/Fleet cloud

Cloud-to-vehicle
API attack

Cloud-to-vehicle
API attack
In-car API
attackUser mobile phone

Connected
vehicleIn-car API
attackUser mobile
phone

Mobile-to-vehicle
API attack

Connected
vehicleUser mobile
phone

Mobile-to-vehicle
API attack

Connected
vehicleFigure 2. API attacks evolved from having single targets to having multiple targets.

Also according to our automotive threat intelligence database, in terms of categories, API attacks
in the automotive industry from 2016 to 2023 primarily consisted of cloud-to-vehicle API attacks(35%) and cloud-based API attacks (30%), followed by mobile-to-vehicle API attacks and in-car API
attacks (each accounting for 13%).

Cloud-to-vehicle API attack

35%

Cloud-based API attack

30%

Mobile-to-vehicle API attack

13%

In-car API attack

13%

Mobile-to-cloud-to-vehicle
API attack

9%

Figure 3. The distribution of API attack categories from 2016 to 2023

From these observations, we can draw three conclusions:•

Cloud-to-vehicle API attacks cover most use cases.

•

Protection of web APIs is necessary but not sufficient by itself.

•

Covering mobile brings additional value.

Is the Automotive Industry Prepared to Navigate
API Security Risks in Software-Defined Vehicles?

3

It is important to note that SDVs inherently rely heavily on APIs. Consequently, the potential
attack surface expands, introducing risks due to the frequent updates of software over-the-air(SOTA) technology. If attackers breach OTA servers and inject malicious software, they could
masquerade as legitimate SOTA update requests, distributing them to vehicles via unauthorized
APIs. The nature of SDVs significantly boosts the attackers’ chances of success. Previously,
OTA updates occurred quarterly, offering only four to five chances per year. The frequency
is expected to increase to potentially 12 to 14 times annually in the future. These factors
underscore the critical importance of automotive API security.

Cloud services

Physical car

VirtualECU

OTADigitaltwin!

Simulation
environment

OEM

!

OEM

!

!

Supplier A

Supplier B

Development life cycle

Figure 4. Risks in the SDV ecosystem

The Risks for OEMs and Fleet Managers
We now examine several reported security incidents related to APIs from the past three years, tobetter understand automotive API security risks.

Remote Hijack of a Vehicle: An API Attack From Halfway Across the World
According to a study by VicOne automotive security researchers, attackers can exploit
compromised account credentials to execute remote attacks on vehicles, even those on theother side of the world. These credentials enable attackers to access a vehicle’s APIs andperform various commands remotely. These commands include fetching the status of thevehicle’s doors and remotely starting the vehicle. Attackers can obtain credentials throughphishing or cyberattacks. Unfortunately, credentials are often managed as general assets
despite the high financial value and privacy risks associated with vehicle fleets.

Is the Automotive Industry Prepared to Navigate
API Security Risks in Software-Defined Vehicles?

4

Initial
accessObtain credentials
from phishing orother cyberattacks.

Execution

ImpactGain access via
mobile app/web
portal or API tocontrol the vehicle
via commands.

Perform vehicle theft,hijack while on theroad, and DoS,
among other possible
scenarios.

Figure 5. The attack chain for remote car hijack via API access

Remote Full Takeover of a Vehicle: Compromised Automotive Cloud Service APIs
In a blog post published in January 2023, Sam Curry, a web application security researcher, andhis team demonstrated how they accessed the back-end cloud infrastructure of various OEMsby exploiting vulnerabilities in telematics systems and APIs. They uncovered a publicly accessible
website for vehicle repair shops that wrote to the same database as the core employee LDAP
(Lightweight Directory Access Protocol) system of a well-known automotive brand. Registeringon this site granted them limited access to employee applications, which they leveraged to gain
further access to sensitive internal applications, including the brand’s GitHub, where they founddetailed instructions for building applications to communicate with customer vehicles.
Their discoveries enabled the compilation of a list of Common Weakness Enumerations (CWEs)
occurring on affected cloud service websites, revealing a gap in the automotive industry’s
awareness of these issues. Two main cloud-related problems were identified: authentication andauthorization issues, and inadequate sanitization of input parameters. The former could lead topre-authentication vulnerabilities and unauthorized access to personally identifiable information(PII), while the latter could expose systems to injection attacks.
These findings underscore the realization that the automotive industry faces security challenges
similar to those faced by the IT industry but it lacks sufficient preparedness to address themeffectively. Implementing proper input validation and sanitization, for example, is crucial
to mitigating the risks, but it remains challenging without coding style guides or a CI/CD(continuous integration and continuous delivery) environment.

Is the Automotive Industry Prepared to Navigate
API Security Risks in Software-Defined Vehicles?

5

Initial
accessExecution

ImpactAccess the back-end
cloud infrastructureof various OEMs.

Compromise
automotive cloudservice APIs.

(Find an SQL injection
vulnerability on
admin.spireon.com.)(Log in any user with thesimple SQL injection“victim #”.)

Fully take over theuser account,disclose PII, or evenstart/stop the engine
remotely.

Figure 6. The attack chain for remote full takeover of a vehicle via
compromised automotive cloud service APIs

Remote Full Takeover of a Fleet: Abuse of a Taxi App’s API
In September 2022, hackers exploited vulnerabilities in a popular Russian taxi app’s API,
resulting in severe traffic congestion in Moscow. The attackers manipulated the API to send
fake taxi orders to the system, overwhelming the service and causing congestion on city streets.
This incident highlights the potential consequences of API security flaws and the necessity of
adopting robust protective measures against such attacks. It emphasizes the importance oftaking proactive security measures to safeguard critical infrastructure and mitigate the impact ofcyberthreats on public safety and urban traffic.

InitialaccessExecution

ImpactReverse-engineer
the taxi app to ﬁnd
API vulnerabilities.

Understand the APIinterface and experimentwith sending requests
continuously.

Manipulate the API toorder dozens of taxis
to the same place.

OWASP—API4:2023—
Unrestricted Resource
Consumption

OWASP—API6:2023—
Unrestricted Access to
Sensitive Business FlowsOWASP—API2:2023—
Broken Authentication

Figure 7. The attack chain for remote full takeover of a fleet via abuse of a taxi app’s API

Is the Automotive Industry Prepared to Navigate
API Security Risks in Software-Defined Vehicles?

6In summary, the threats and risks resulting from API vulnerabilities include:•

OTA spoofing: Unauthorized API calls can mimic legitimate OTA update requests.

•

Cyberattacks/Ransomware incidents: APIs can be a gateway for attackers to infiltrate
systems and deploy ransomware.

•

Vehicle entry/Immobilizer systems: API flaws can allow unauthorized access to vehicle
control systems.

Complete API and Security Risk Visibility for SDVs,
From Design to On-Road, All in One Platform
To effectively mitigate API security risks in the expansive automotive ecosystem, it is essential to
implement a systematic approach. Since every component represents a potential attack surface,comprehensive strategies are necessary. According to a Gartner® report, titled Innovation
Insight for API Protection, “API protection products provide three main types of functionality— discovery, posture management and runtime protection.”* Building upon these principles,
VicOne and 42Crunch have joined forces to provide an integrated solution that enables
continuous discovery, posture management, and runtime protection to address automotive
supply chain API security risks across the automotive life cycle.

Design/Development

Test/Production

On-RoadContinuous Discovery

Runtime Protection(Identify Software and API Vulnerabilities)(Detect and Respond to Threats)

VicOne xZETA Automotive Vulnerability
and SBOM Management System

VicOne xCarbon IDS/IPS
VicOne Smart Cockpit Protection

42Crunch API Audit

42Crunch API Protect

Risk Assessment(Backed by VicOne’s Access to 30+ Years of Threat Intelligence and Zero-Day Vulnerability Expertise)
VicOne xNexus Next-Gen VSOC Platform

Figure 8. A comprehensive and practical solution provided by VicOne and 42Crunch throughout the automotive life cycle

In the design or testing phase, the key is the continuous identification of software and API
vulnerabilities before attackers find them. With 42Crunch’s API Audit, API misconfigurations and
API vulnerabilities can be identified. For instance, with regard to the case involving compromised
automotive cloud service APIs, SQL injection vulnerabilities can be identified during the designphase, thus eliminating the latest Open Worldwide Application Security Project (OWASP) top 10
API security vulnerabilities during development to prevent them from becoming serious threats
when the system operates in the future, and empowering shift left.
Is the Automotive Industry Prepared to Navigate
API Security Risks in Software-Defined Vehicles?

7

With VicOne’s xZETA automotive vulnerability and software bill of materials (SBOM) management
system, the generation of SBOMs can be automated to enhance ongoing threat detection. Zeroday, undisclosed, and known vulnerabilities, along with malware, ransomware, and advanced
persistent threats, can be uncovered within binaries and firmware. As a result, vulnerabilities
in both APIs and firmware can be mitigated before becoming serious threats when the system
operates in the future.
For vehicles on the road, 42Crunch’s API Protect is tailored to protect each API from malicious
attacks and enforce API runtime protection directly in front of APIs. On the other hand, with
VicOne’s xCarbon intrusion detection or prevention system (IDS/IPS) and Smart Cockpit
protection solutions, anomalies like malicious CAN (controller area network) messages, denialof-service (DoS) attacks, and abnormal API transactions can be detected. Through runtime
protection, detection of and response to threats can be done in real time.
Full visibility is essential to arriving at a common understanding of both in-vehicle and backend infrastructure issues and challenges. By bringing all vulnerabilities and security events,from the design phase to on-road runtime detection, to VicOne’s xNexus next-gen vehicle
security operations center (VSOC) platform, unified risk visibility can be achieved. With artificial
intelligence (AI) and large language modeling (LLM), these vulnerabilities and security events
can be correlated into contextualized attack paths. These contextualized attack paths, in turn,enable OEMs and suppliers to gain precise, actionable threat insights, facilitating continuous anddynamic risk assessment across the automotive supply chain.
For example, in the case of the abused taxi app API incident, with our integrated solution, broken
authentication or token anomalies in APIs can be detected right from the initial access. As theattackers begin testing, we can detect unrestricted resource consumption and abnormal API
transactions.
Initialaccess1

2

3

Execution

ImpactReverse-engineer
the taxi app to ﬁnd
API vulnerabilities.

Understand the APIinterface and experimentwith sending requests
continuously.

Manipulate the API toorder dozens of taxis
to the same place.

OWASP—API2:2023—
Broken Authentication

OWASP—API4:2023—
Unrestricted Resource
Consumption

OWASP—API6:2023—
Unrestricted Access to
Sensitive Business Flows

Detect broken
authentication or token
anomalies in APIs.

Detect unrestrictedresource consumption
and abnormal API
transactions.

Detect abnormal accessto sensitive businessprocesses andsuspicious DDoS.

Figure 9. How our solution can help against this kind of attack
Is the Automotive Industry Prepared to Navigate
API Security Risks in Software-Defined Vehicles?

8

Sharper Insights, Lower Anxiety: Risk Navigation in SDVs
Our integrated solution allows OEMs and suppliers to initially assess API security issues within
their ecosystem (in-vehicle, mobile, web), and OEMs to then quickly turn around to remediate
these issues. It enables continuous discovery, posture management, and runtime protection toaddress automotive supply chain API security risks with the following benefits:•

Enriched risk visibility for better risk prediction: Full visibility into API security and otherautomotive-related risks across the full automotive ecosystem.

•

Optimized resource allocation: Improved dynamic risk assessment through the integrationof API security events along with other automotive data and security events.

•

Precise threat detection: Quicker and more accurate detection of the latest OWASP top 10
API security vulnerabilities.

•

Contextualized risk visibility: Actionable threat insights drawn from the correlation of
security events and data across the entire ecosystem.

•

A highly integrated, future-proof solution: Seamless phased implementation andeffortless scaling from agentless to agent to support the automotive life cycle for decades
without disruption.

Contact us to learn more about how we can help you navigate API security risks in SDVs.

*Gartner, Innovation Insight for API Protection, Dionisio Zumerle, Jeremy D’Hoinne, et al,
2 February 2024. (For Gartner Subscribers only) GARTNER is a registered trademark andservice mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and isused herein with permission. All rights reserved.

Is the Automotive Industry Prepared toNavigate API Security Risks in SoftwareDefined Vehicles?
Copyright © 2024 VicOne Inc.
All Rights Reserved.

Learn more about VicOne
by visiting VicOne.com orscanning this QR code: