Hacking into Toyota’s global supplier management network

guest · Feb 7, 2023

Researcher breaches Toyota supplier portal with info on 14,000 partners
By Bill Toulas @billtoulas - February 7, 2023

Toyota's Global Supplier Preparation Information Management System (GSPIMS) was breached by a security researcher who responsibly reported the issue to the company.

GSPIMS is the car manufacturer's web application that allows employees and suppliers to remotely log in and manage the firm's global supply chain.
Click to expand...

The security researcher, who publishes under the pseudonym EatonWorks, discovered a "backdoor" in Toyota's system that allowed anyone to access an existing user account as long as they knew their email.

The issues were responsibly disclosed to Toyota on November 3, 2022, and the Japanese car maker confirmed they had been fixed by November 23, 2022.
EatonWorks published a detailed writeup about the discoveries today after 90 days disclosure process had passed.
Click to expand...

Full access to classified docs
A system administrator on GSPIMS can access sensitive information like classified documents, project schedules, supplier rankings, and user data for 14,000 users.

For each of them, the admin can access their projects, tasks, and surveys, change user details, modify or delete data, add redundant backdoor users, or lay the ground for a targeted phishing campaign.
Click to expand...

EatonWorks: Hacking into Toyota’s global supplier management network

February 6, 2023
Key Points / Summary:
• I hacked Toyota’s Global Supplier Preparation Information Management System (“GSPIMS”), a web app used by Toyota employees and their suppliers to coordinate projects, parts, surveys, purchases, and other tasks related to the global Toyota supply chain.
• System Admin access achieved through accidentally introduced backdoor as part of a user impersonation/”Act As” feature.
• Any user could be logged in to just by knowing their email, completely bypassing the various corporate login flows.
• Read/write access to the global user directory containing 14k+ users was achieved.
• Data access achieved: 14k+ corporate user account details, confidential documents, projects, supplier rankings/comments, and more. Data access was global and not limited to North America.
• Issue was responsibly disclosed to Toyota in November 2022 and fixed in a timely manner.
Click to expand...

guest · Feb 9, 2023

‘No evidence of malicious access,’ Toyota says about serious bug exploited by outside researcher
By Jonathan Greig @jgreigj - February 8, 2023

Toyota says it has fixed a vulnerability discovered by an outsider that allowed for widespread access to a platform used by employees to coordinate operations.
Click to expand...

Security researcher Eaton Zveare published a blog post Monday explaining how he managed to gain full control of the web app, called the Global Supplier Preparation Information Management System (GSPIMS), in October 2022. The platform is used to coordinate projects, parts, surveys, purchases and more.

“We promptly remediated the reported vulnerability and confirmed that there was no evidence of malicious access to Toyota systems,” a company spokesperson said in a statement to The Record. They referred other researchers “interested in partnering with Toyota” to its coordinated disclosure program at hackerone.com/toyota.
Click to expand...

Zveare said he had access to a directory of more than 14,000 users, as well as account details, confidential documents, projects, supplier rankings/comments, and more.
His access also spanned all of Toyota’s systems worldwide. He reported the issue to Toyota in November and it was fixed quickly.

The Toyota spokesperson confirmed that Zveare contacted the company about the issue.

“Toyota takes cyber threats very seriously. We regularly test our systems and also run a coordinated disclosure program to allow security researchers to report vulnerabilities. We appreciate the research performed by Eaton,” the spokesperson said.
In his blog post on the vulnerabilities, Zveare provided evidence of widespread access, sharing screenshots of internal systems, users, and more.
Click to expand...

Log in or Sign up

Hacking into Toyota’s global supplier management network

guest Guest

guest Guest

Log in or Sign up

Hacking into Toyota’s global supplier management network

guest Guest

guest Guest

Useful Searches