Automotive manufacturer: 2-week automated scan exposes critical attack surface

A leading German automotive manufacturer commissioned DSecured to conduct a Proof of Concept analyzing their external attack surface using Argos. In just 2 weeks, over 15,000 assets were scanned fully automatically - with alarming results.

The automotive conglomerate operates a highly complex, globally distributed IT infrastructure with tens of thousands of assets - from production facilities to Connected-Car services, dealer portals, and internal development systems. The security team faced multiple challenges:

• Unknown Shadow IT: No complete visibility into all externally accessible systems and subdomains.
• Lack of Transparency: Development teams work autonomously - new services go live without notifying Security.
• Manual Resource Shortage: Insufficient staff to regularly assess thousands of systems.
• Compliance Pressure: VDA ISA and ISO 27001 require demonstrable control of the external attack surface.

The Goal: Within 2 weeks, gain comprehensive visibility of the external attack surface and identify concrete vulnerabilities that an attacker could exploit as an entry point. The primary question was: "How much Shadow IT actually exists, and what critical security gaps are present?"

Argos conducted a fully automated external attack surface scan. Unlike manual penetration tests, Argos analyzes continuously and comprehensively - ideal for large, dynamic infrastructures.

The results of the 2-week scan were both impressive and alarming - both for DSecured and for the client:

Critical Security Gaps in Detail

• Source Code Leaks on GitHub: Multiple repositories containing internal code, including credentials, API keys, and architecture documentation - freely accessible to any attacker.
• Exposed Archives: Publicly accessible files such as bin.rar, admin.zip, backup.tar.gz containing configuration files, database dumps, and credentials.
• Hardcoded Credentials: Numerous .env files, config.json, and similar configuration files with passwords, database credentials, and API tokens in plain text.
• Default Credentials: Admin panels (e.g., Kibana, Jenkins, Grafana) with default passwords like admin:admin or root:root - directly usable.
• XXE (XML External Entity) Vulnerabilities: Multiple APIs allowed XML entity injection, enabling extraction of local files.
• RCE (Remote Code Execution): Critical vulnerabilities in outdated frameworks enabling execution of arbitrary code on production servers.

Shadow IT & Unknown Assets

A particularly alarming finding: 312 systems were completely unknown to the security team. Among them:

• Forgotten developer staging environments with production data
• Test APIs without authentication
• Cloud buckets with sensitive documents
• Old marketing websites with unpatched CMS systems
• External service provider integrations without security review

Each of these systems represented a potential entry point - and none were actively monitored or maintained.

This project delivered several critical insights - not only for the client, but for the entire industry:

Why These Findings Are So Dangerous

Many of the identified vulnerabilities appear non-critical at first glance: a forgotten archive here, a default password there. Yet in reality, these very "low-hanging fruits" are used as entry points for complex attack chains:

The results of the 2-week Argos scan had immediate and measurable impact on the company's security posture:

Immediate Actions After Scan Completion

• Critical vulnerabilities closed: All 127 critical findings were prioritized and systematically remediated - RCE vulnerabilities were closed within 48 hours.
• GitHub repositories cleaned: Source code leaks were removed, affected credentials immediately rotated, 2FA enforced for all repositories.
• Shadow IT documented: The 312 unknown systems were fully inventoried, assessed, and either decommissioned or integrated into regular security processes.
• Default credentials eliminated: Company-wide review of all admin panels, default passwords changed, new security policies implemented.
• Exposed archives secured: All publicly accessible archives (bin.rar, admin.zip, etc.) were removed from servers or protected with authentication.

Organizational Improvements

Measurable Results

ROI & Prevention

The value of the 2-week scan was substantial:

• Critical breaches prevented: The identified RCE vulnerabilities and attack chains could have led to complete system compromise.
• Reputation protection: Data leaks and potential customer data breaches were preventively stopped - invaluable for brand image.
• Compliance evidence: Complete documentation of the attack surface helped with VDA ISA and ISO 27001 audits.
• Efficiency: More found in 2 weeks automated than in years of manual security audits - at a fraction of the effort.
• Cost-benefit: The investment in the scan was negligible compared to potential costs of a security incident (millions for forensics, PR, downtime, fines).

Based on insights from this project, we recommend the following best practices for organizations with large, complex IT infrastructures:

1. Continuous Attack Surface Monitoring Is Mandatory

With thousands of assets, annual or quarterly testing is insufficient. New systems go live daily, developers commit code, configurations change. Only continuous, automated monitoring catches vulnerabilities before attackers do.

2. Detect and Manage Shadow IT

Shadow IT is inevitable in large organizations. The key is not preventing it, but detecting it early and integrating it:

• Regular asset discovery scans (at least weekly)
• Automatic alerts for new, unknown domains/subdomains
• Clear process for registering new services with the Security team
• Security Champions in each development team as primary contacts

3. "Shift-Left" Security in Development

Many of the identified vulnerabilities could have been prevented through early integration of security in the development process:

• Pre-Commit Hooks: Secret scanning before every Git push
• CI/CD Security Gates: Automatic SAST/DAST scans in build pipelines
• Infrastructure as Code (IaC) Scanning: Check Terraform/CloudFormation for misconfigurations
• Container Image Scanning: Scan all Docker images for vulnerabilities before deployment

4. Regular Manual Pentests as Complement

Automated tools are essential for scaling, but they don't replace the human eye. Recommended hybrid approach:

• Continuous: Argos for comprehensive, automated 24/7 monitoring
• Quarterly: Manual pentests for critical systems and complex business logic
• On Changes: On-demand tests after major releases or architecture changes
• Annually: Comprehensive red teaming for entire attack surface

For Your Organization

Ready to assess your external attack surface? We offer a free 2-week Argos PoC to analyze your attack surface and uncover critical vulnerabilities.