Struggling to convey cybersecurity risks to your board? Our eBook offers actionable insights for CISOs, helping you present accurate, meaningful reports with confidence. Elevate your board ...

Curry reportedly figured out the methods dealers use to assign new cars to owners using Kia's KDealer platform. He then found a flaw in the KDealer API, which allowed him to impersonate a dealership ...

In a blog post, Sam detailed how the team was able to access Kia's backend dealer API by registering for a dealer account on Kia's kiaconnect.kdealer.com portal. Once authenticated, they obtained ...

Curry said that while his group’s forays into the owners.kia.com site this time around were less fruitful, the group soon discovered the existence of another, previously undisclosed web application, ...

A new proof of concept released this week—simply called Kiatool—is probably the most powerful attack against any Kia we've ...

The researchers registered a dealer account on Kia's kiaconnect.kdealer.com dealer portal to gain access to this information. Once authenticated, they generated a valid access token that gave them ...

The crux of the research is that the issues exploit the Kia dealership infrastructure ("kiaconnect.kdealer[.]com") used for vehicle activations to register for a fake account via an HTTP request and ...