Web hackers vs. the auto industry
A few recurring patterns here:<p>- Broken API authentication mechanisms, SSO that doesn&#x27;t work properly. The frequency with which they could simply register accounts and then make themselves some sort of admin by sending ordinary HTTP requests, without ever once needing to confirm with anyone in person, is  quite astounding.<p>- Everything being totally exposed on the internet: frontends, backends, all of it. Apparently IP firewalls are history.<p>- Stringly typed APIs and protocols in which adding escaped control characters in various places allows bypass of critical comparison logic.<p>- And a bit of SQL injection. Apparently only worth looking for on old web apps - progress?<p>It feels like the ad-hoc way user accounts were added to the web platform have led to a universe of different implementations and varying exploits. Still, it&#x27;d be good to know what their failure rate was. How many companies did they attack without finding any (serious) problem?