Join Traceable by Harness at Black Hat USA 2025

Booth #2264 is located towards the back of the expo hall, near Business Hall Theater A. Play our custom slot machine for your chance to take home one of our plush canaries or the Lego Set grand prize!

Connect with our technical experts at a demo station to walk through our products and ask any questions you
may have.

Swingers Las Vegas, located in Mandalay Bay Resort & Casino, blends mini-golf, craft cocktails, and a vibrant atmosphere. Spanning 40,000 sq. ft., it features four themed crazy golf courses, immersive decor, DJ sets, arcade games, and top-tier food from Emmy Squared Pizza.

Join Traceable by Harness for an evening full of cocktails, small bites, and networking in Las Vegas from 6:30 PM to 8:30 PM, right by the self-parking garage entrance, across from Carama and next to S Bar on Tuesday, August 5th.

Join Traceable by Harness for a VIP Networking Dinner at Bourbon Steak in the iconic Four Season Hotel during Black Hat USA in Las Vegas, NV. Enjoy a modern reimagining of the classic American steakhouse, paired with signature cocktails, and great company in attendance – space is limited.

Dealers are a vital part of the automotive industry – intentionally separate entities from the manufacturers, but highly interconnected. Most dealers use platforms built by the manufacturers that can be used to order cars, view/store customer information, and manage their day-to-day operations. Earlier this year, new vulnerabilities were discovered in a top automaker’s dealer platform that enabled the creation of a national admin account. This level of access, a privilege reserved for a select few corporate users, opened the door to a wide range of fun exploits.

Want to start a car? Forget VINs – all you needed was someone’s name. Access to the enrollment systems made it possible to reassign ownership of cars and access remote control functionality.

Want to find out who owns that sleek ride next to you? A quick glance at the VIN on the windshield was all you needed to pull down the owner’s personal information using the customer lookup tool.

Want to impersonate the owner of a dealership to gain full access to everything? A user impersonation function was uncovered that made this possible - negating all the two-factor authentication systems.

All of this and much more was made possible through API flaws in a centralized dealer system. A system used by more than 1,000 dealers in the USA that you didn’t even know existed. A system that you would never have thought would be the unexpected connection to your car. We break down the full exploit from recon to initial access, from viewing PII to the satisfying roar of an engine coming to life.