API Security for Connected Cars and Fleets: My CyberSafe Training Experience (Week 8)

Introduction

In 2022, Automotive and Smart Mobility API related incidents increased by 308%, accounting for 12 percent of total incidents. The alarming aspect is that most attacks are now being executed remotely, eliminating the need for physical tampering, which contributes to the scale of attacks and the number of impacted assets.

Real-World Examples

Here are some publicly reported attacks on Connected Cars and Fleets:

• Tesla Vehicles Compromised via Teslamate (Third-Party App): David Colombo, a 19-year-old hacker and security researcher, was able to control more than 25 Teslas around the world without their owners’ knowledge by exploiting a vulnerability in a third-party app called Teslamate. He found the source code of a third-party software and discovered the vulnerability.
• SiriusXM Connected Vehicle Services Breach: Sam Curry, a security engineer, discovered a vulnerability in SiriusXM’s connected vehicle services that allowed him and his team to remotely start, unlock, locate, flash the lights, and honk the horn on cars. He was able to identify a flaw in the authentication process that allowed him to gain unauthorized access to connected vehicle services.
• US-Based Fleet Management Ransomware Attack: A ransomware group attacked ORBCOMM’s IT systems, rendering some of their services inoperable, and customers were unable to track their fleets, and the truck drivers were forced to go back to traditional paper logs.
• EV Charging Company Data Breach (U.S.): An unauthenticated database of approximately 1TB of logs was exposed, leaking PIIs, including Vehicle Identification Numbers (VINs), and the locations of public and private charging stations, affecting both fleets and individual EV users.
• Moscow Traffic Jam 2022 (Yandex Taxi API Abuse): Yandex Taxi’s mobile app services were abused by hacktivists who exploited backend APIs to mass-dispatch hundreds of drivers to a single location, causing city-wide traffic gridlock in Moscow.

API Attack Surfaces & Impact

The OWASP API Security Top 10 provides foundational guidance for identifying vulnerabilities, and the goal here is to heighten awareness of the most vulnerable aspects of APIs and ensure that developers and cybersecurity professionals are mindful of these vulnerabilities when developing and deploying code.

The Operational Perspective for API Security

Single API calls must be analyzed in context to detect anomalies. Example: A user connecting 50 VINs to one account is suspicious, even if individual API calls seem normal. Context is derived from operational data (vehicle status, IP addresses, engine state) and API traffic patterns.

Digital Twins

A digital twin is a snapshot of an asset (vehicle, API endpoint, or user) at a specific point in time. It provides a holistic view of asset state, enabling anomaly detection and trend analysis. Digital twins are applied to endpoints, API consumers, and vehicles to identify suspicious behavior across fleets or ecosystems.

Operational and Physical Impact of a Breach

APIs directly influence real-world systems, i.e., vehicles, fleets, mobility services, and EV charging infrastructure. Threats can have physical consequences, like fleet disruptions or city-wide traffic gridlocks. API misuse must be correlated with operational data to understand its impact on product safety and data privacy.

Threat Detection and Response

Combining API traffic with operational data allows detection of:

• Third-party vulnerabilities
• Misconfigurations
• Business logic flaws
• Design flaws
• Near-real-time monitoring enables quick mitigation through virtual SOCs or in-house cybersecurity teams.

Next Generation API Security Detection

Here are some next-generation API security detection and mitigation strategies:

1. Scalable API Monitoring & Data Ingestion: Next-generation API security relies on tools that can scale with massive API traffic and ingest high-volume data from APIs, vehicles, IT, and OT systems to detect threats without performance loss.
2. Context-Aware Detection Using Operational Data: API behavior is analyzed in context by correlating API calls with operational signals such as vehicle state, user behavior, IP data, and OT telemetry to identify anomalies that single transactions alone cannot reveal.
3. Customizable & No-Code Detection Rules: Security teams must rapidly adapt to new attack patterns and business logic abuse using no-code detection capabilities that allow quick response without heavy development effort.
4. Shift-Left API Security Integration: Embedding API security early in the development lifecycle ensures misconfigurations and logic flaws are identified before deployment, reducing large-scale risk to connected vehicles and fleets.
5. Automated Response with SOAR: This will help in streamlining and enhancing an organization’s cybersecurity operations by automating tasks, orchestrating workflows, and rapidly responding to cyber threats.

Conclusion

Securing APIs is complex, but within the transportation ecosystems, it has become increasingly clear that an operational-focused approach is not just beneficial but essential.

The integration of the operational context is the key to unlocking a more secure and resilient future in an increasingly connected ecosystem.

References

• https://www.oreateai.com/blog/analysis-of-hackers-misusing-yandex-taxi-api-to-create-massive-traffic-congestion-in-moscow/dfb9553a8e00492fccc4d23d9c20c611
• https://university.apisec.ai/products/api-security-for-connected-cars-and-fleets/categories/2153990043