How I hacked 30 mobile banking apps & the future of API Security
summary
Research downloads and statically analyzes 30 mobile banking and fintech apps, using MobSF and grep plus REST clients like Arc/Postman and API extractor, and reports 29 of 30 apps contain exposed secrets. Average time to find usable credentials is 8.5 minutes per app. Findings include hard-coded AWS keys, private keys with no password, hard-coded IVs, public API docs that reveal merchant IDs and tokens, servers that accept only an API key for auth, and exposed S3 data. Recommended fixes: obfuscation, tamper detection, API gateways, static and dynamic analysis, and pen testing.
AI-written summary · about
chapters (5)
- 0:00Start
- 7:06Static Code Analysis
- 8:32Vendor Api Documentation
- 29:16Global Talent Shortage in Cybersecurity
- 29:56Hackers Will Go to the Weakest Link
related talks
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
53mAre your secrets secure? How mobile applications are leaking millions of credentials
32mResults of Scanning the Top 45 Android Mobile Banking Apps
26mHack Your APIs in 15 Minutes or Less
24mMobile - Your API Security Blindspot
01h 01mPrincess of Thieves: How I Robbed 30 Banks
42mHack My App: Learn Flutter Security by Breaking It