Track me if you can: Exploiting vehicle tracking APIs in a major automaker

It's convenient being able to track your vehicle, but what if everyone else could as well? I'll tell you the story of how a vulnerable admin panel and API in a major automaker let me track, in real-time, the location of every one of their trucks worldwide. I'll take you through how I bypassed the authentication and how the issue was ultimately resolved.