Toyota supplier portal breached by white hat hacker

A white hat hacker breached Toyota's global supplier management web portal, gaining read-and-write access to 14,000 corporate email accounts, associated confidential documents, projects, supplier rankings, comments and other information.

Eaton Zveare, a 29-year-old hacker-hobbyist in Sarasota, Fla., notified the automaker of the breach in November, and it was quickly closed.

"Toyota takes cyber threats very seriously. We regularly test our systems and also run a coordinated disclosure program to allow security researchers to report vulnerabilities," Corey Proffitt, Toyota Connected North America's senior communication manager, said in an email to Automotive News.

"We appreciate the research performed by Eaton. We promptly remediated the reported vulnerability and confirmed that there was no evidence of malicious access to Toyota systems."

Toyota Motor Corp.'s employees and suppliers access the company's Global Supplier Preparation Information Management System through an application to coordinate projects and distribute parts, handle surveys and purchases and perform other tasks related to the automaker's global supply chain.

Zveare found he could penetrate the web portal by generating a JSON web token with a corporate Toyota email address, even without a password.

A JSON web token allows an individual to use a valid authenticated session on a website. Typically, it is issued after a user has logged into a website with an email and password to access secured parts of the site with a verified identity.

To gain a JSON web token for the portal, Zveare searched the Internet for Toyota supply chain employees. Using the format, [email protected], Zveare entered the name of a Toyota employee and found a successful match. After searching the portal, he found an account with system administrator privileges and used that same process to gain read-and-write access to 14,000 corporate Toyota email accounts.

In an email to Automotive News, Zveare, a part-time beekeeper and director of technology at a digital retailer, said Toyota's retail customers should not be concerned because the hack did not expose any of their personal information.

"On the other hand, Toyota partners/suppliers should be deeply concerned that their corporate email addresses and other information about their Toyota relationship could have been easily dumped and sold on the black market for phishing campaigns or other malicious purposes," Zveare said.

Zveare is part of a cadre of white hat hackers who go searching for vulnerabilities in hopes of a reward.

Although Toyota appreciated his security research, Zveare didn't collect the reward he anticipated.

"Given how much profit they make per year, I think they should definitely allocate some to their security teams that they can use to reward researchers," Zveare said. "While recognition is always appreciated, if you don't offer money, it might be more appealing for hackers to sell their exploits on the black market."

Toyota has a formal program for security researchers looking into potential vulnerabilities. Proffitt said that researchers interested in partnering with Toyota are encouraged to visit www.hackerone.com/toyota.

This is the second major security issue Toyota has faced in recent months. In September, white hat auto hacker Sam Curry and other software security researchers were able to gain access to the personal information of Toyota customers via a telematics service provided by SiriusXM.

In a later development, Toyota disputed Curry’s claim that customers’ personal information was exposed when Curry hacked into the SiriusXM telematics back-end portal.

The telematics services SiriusXM provides to Toyota and Lexus are different than the ones provided on the vehicles Curry and his team accessed, Proffitt said.

The company acknowledged a separate second security breach involving Toyota Motor Credit Corp. that has been addressed. The latter breach had no connection to vehicles, the company said in a statement.