Reposting my comment from netsec.<p>I&#x27;m not sure why Troy can&#x27;t just refer to others public research directly instead of repackaging it and using &quot;responsible disclosure&quot; as a cover for not sharing his (public) sources.<p>It seems sketchy at best, dishonest at worst.<p>&gt;A GitHub repository documenting the API including the observation that “All other operations take the DCMID and the VIN of your vehicle as parameters for authorizing the requested operation” (although the DCMID value is not actually required and is empty in many of the examples above)<p><a href="https:&#x2F;&#x2F;gist.github.com&#x2F;joshperry&#x2F;15eadc2a63b22632d6ae" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;joshperry&#x2F;15eadc2a63b22632d6ae</a><p>&gt;Another GitHub repository, this time a Python script to connect to and manage vehicle features via the API (also includes region codes for managing vehicles in other parts of the world)<p><a href="https:&#x2F;&#x2F;github.com&#x2F;jdhorne&#x2F;pycarwings2" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;jdhorne&#x2F;pycarwings2</a><p>&gt;Yet another GitHub repository built to target an earlier generation of the service and referenced as inspiration for the previously mentioned project<p>probably <a href="https:&#x2F;&#x2F;github.com&#x2F;haykinson&#x2F;pycarwings" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;haykinson&#x2F;pycarwings</a><p>&gt;A blog post on reverse engineering the API which observes that “curiously, it seems like you just need the constant DCMID and VIN fields” (again, the DCMID parameter wasn’t actually used in our tests)<p><a href="http:&#x2F;&#x2F;virantha.com&#x2F;2016&#x2F;01&#x2F;12&#x2F;reverse-engineering-nissan-connect-ev-protocol&#x2F;" rel="nofollow">http:&#x2F;&#x2F;virantha.com&#x2F;2016&#x2F;01&#x2F;12&#x2F;reverse-engineering-nissan-co...</a><p>&gt;A forum post on integrating the data into Domoticz (a home automation system) which makes this observation: “No other authentication necessary!”<p><a href="http:&#x2F;&#x2F;www.domoticz.com&#x2F;forum&#x2F;posting.php?mode=quote&amp;f=31&amp;p=74015&amp;sid=da7f9475540847278474d2dd29baf039" rel="nofollow">http:&#x2F;&#x2F;www.domoticz.com&#x2F;forum&#x2F;posting.php?mode=quote&amp;f=31&amp;p=...</a><p>IMO, his behaviour is straight up despicable. This stuff isn&#x27;t hard to find, but he still refuses to give proper credit because of &quot;responsible disclosure&quot;. Yet, anyone interested in attacking the API can and will find this stuff on google.<p>Also, another example of Troy BS:<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;troyhunt&#x2F;status&#x2F;701733562253336576" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;troyhunt&#x2F;status&#x2F;701733562253336576</a><p>Trying to publicly shame vkontakte for a nonexistent SQLi (this is a wiki page that anyone can edit, here&#x27;s a wikipedia example demonstrating the same &quot;vulnerability&quot; <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;w&#x2F;index.php?title=%27&amp;diff=706317017&amp;oldid=646978585" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;w&#x2F;index.php?title=%27&amp;diff=70631701...</a>)