IoT Penetration Testing Cookbook

Step 5 - Exploitation -- Chaining vulnerabilities

At least 11 vulnerabilities have been identified through passive and active analysis. Some of the vulnerabilities can be directly exploited while others may be indirectly exploited because of the application's logic and design. With the goal of accessing a vehicle without a key fob, car keys, or credentials, we should have what we need.

Looking through the identified security bugs, user intervention will be needed to successfully exploit a MySubaru owner's account and vehicle. There are several ways in which we can do this. We can try the following attack scenario which relies on a form of social engineering:

• Craft a malicious page that employs an XSS payload for the vehicle's nickname