Application Penetration Testing

OUR TARGETS

• Web Applications
• Backends and APIs
• Mobile Applications: iOS and Android
• Fleet Management Solutions
• Telemetry Systems
• Connected Car Platforms
• Industry-Specific Cloud Applications
• Over-the-Air (OTA) Update Systems
• Desktop Applications: Windows and Linux
• Databases
• Content Management Systems (CMS)

SERVICE GOAL

The objective is to thoroughly assess and fortify the security of applications, ensuring they are resilient against cyber threats. This includes safeguarding data integrity, availability, and confidentiality across different platforms and industries.

BUSINESS BENEFITS

Enhanced Security Posture

Identify and address vulnerabilities before attackers can exploit them.

Regulatory Compliance

Ensure adherence to industry standards and avoid legal penalties.

Operational Continuity

Prevent disruptions and maintain customer trust and loyalty.

SERVICE DESCRIPTION

Vulnerability Assessment

Our service identifies security weaknesses across all platforms, utilizing both automated scans and manual testing techniques to ensure comprehensive coverage.

OWASP Model Application

We employ the OWASP model specifically designed to assess the security of web and mobile applications. This model is adapted to account for potential errors due to an excessive number of parameters, ensuring thorough evaluation.

Industry-Specific Focus

At PCAutomotive, we tailor our testing to address the unique needs of the automotive industry and other sectors. We focus on connectivity, data integrity, and fleet management requirements, evaluating risk levels by considering both the likelihood of threats and the potential technical and business impacts.

Simulation of Cyber Attacks

Our team executes sophisticated attack scenarios, including SQL injection and cross-site scripting, to test and evaluate system responses under real-world conditions.

Risk Analysis and Mitigation

We analyze the potential impacts of identified vulnerabilities and provide strategic recommendations for mitigation, helping you enhance your security posture.

Real-World Testing Scenarios

Beyond standard compliance and vulnerability scanning, we implement real-world attack simulations to assess the actual resilience of your systems against cyber threats.

Reporting and Recommendations

PCAutomotive delivers detailed reports that outline identified vulnerabilities, their potential impacts, and actionable steps for remediation. We also offer ongoing support to help implement and maintain robust security measures.

PROVEN EXPERIENCE OF OUR TEAM

Affected Applications	CVEs
ONLYOFFICE Document Server versions 4.0.3 through 7.3.2	CVE-2023-30186, CVE-2023-30187, CVE-2023-30188, CVE-2022-45902, CVE-2022-45903, CVE-2022-45904, CVE-2021-3199, CVE-2021-33833, CVE-2021-25829, CVE-2021-25830, CVE-2021-25831, CVE-2021-25832, CVE-2021-25833
Adobe Media Encoder version 14.3.2	CVE-2020-9739, CVE-2020-9744, CVE-2020-9745
Janus WebRTC Server	CVE-2020-13898, CVE-2020-13899, CVE-2020-13900
Windows Core Shell COM Server Registrar	CVE-2019-1184
Microsoft Office Excel Equation Editor	CVE-2019-14715, CVE-2019-14716
SAFE’N’SEC SoftControl/SafenSoft SysWatch, TPSecure, and Enterprise Suite (versions before 4.4.x)	CVE-2018-13012, CVE-2018-13013, CVE-2018-13014
Trend Micro Maximum Security (Consumer)	CVE-2018-6236, CVE-2018-6232, CVE-2018-6233, CVE-2018-6234, CVE-2018-6235
Trend Micro OfficeScan	CVE-2018-10505, CVE-2018-10359, CVE-2018-10358
Cisco WebEx Business Suite	CVE-2018-0288

OUT METHODOLOGY

We rely on the PTES (Penetration Testing Execution Standard) methodology to perform penetration testing. The PTES methodology includes several phases to ensure comprehensive testing:

1. Pre-engagement Interactions: Planning and defining the scope of the test.
2. Intelligence Gathering: Collecting information about the target.
3. Threat Modeling: Identifying potential threats to the system.
4. Vulnerability Analysis: Finding and prioritizing vulnerabilities.
5. Exploitation: Attempting to exploit vulnerabilities to gain access.
6. Post-exploitation: Assessing the impact and maintaining access.
7. Reporting: Documenting findings and providing recommendations.

WHY PCAUTOMOTIVE?

Team certifications

• Offensive Security OSCP
• Offensive Security OSCE
• Advanced Security Training: Hardware Hacking with FPGAs
• CISSP
• ISO/SAE 21434

Expertise

• Our team has deep expertise with a proven record of application penetration testing across various industries.

Proven record of success

• 100+ security evaluations conducted.
• 50+ automotive vulnerabilities found in 2023.
• Found critical vulnerabilities in the top automotive brands.
• Our experts belong to the hall of fame of industry leaders such as BMW and Siemens.

Conference Talks and Competitions:

• BlackHat USA 2018
• Recon Brussels 2018
• DefCon 28
• BlackHat Europe 2020
• Standoff 2020
• Secure Our Streets 2023
• Hacktivity Budapest 2023
• Escar 2023
• Pwn2Own Automotive Tokyo 2024

On-site center of expertise

PCAutomotive possesses a CyberGarage for conducting full vehicle penetration testing and a CyberLab for advanced hardware analysis. Our CyberLab and CyberGarage offer top-tier execution and privacy. Built by our in-house experts, PCAutomotive’s Security Garage is equipped with advanced research tools, enabling comprehensive security assessments for any industry at the highest standards.

PCAutomotive at Pwn2Own Automotive 2024 in Tokyo

PCAutomotive team was awarded a significant $46,000 prize at the prestigious Pwn2Own Automotive competition, held in Tokyo on January 23-25, 2024. The team demonstrated proof-of-concept attacks against Alpine Halo ILX-F509 infotainment unit via Bluetooth channel, and against Enel Juicebox 40 EV charger via Wi-Fi de-authentication and exploitation of the vulnerability in the charger’s web management interface. The team promptly reported the discovered vulnerability to the vendors, ensuring a responsible approach to cybersecurity enhancements.

Contact us today