Apisecure, 14 & 15 March 2023 - Arik Atar, Threat Intelligence Researcher at Human Security.
summary
Claims that API endpoints become the preferred vector for credential stuffing, with observables showing a 72% increase in API-focused stuffing scripts; a November DraftKings operation uses decompiled mobile SDKs, mail-validation/user-enumeration, mobile-spoofed headers, and captcha farming to harvest accounts then sell them to cash-out buyers, yielding about $300,000 stolen in four days; attacker runs an affiliate-driven Telegram shop and publishes Silver Bullet–style configs after the attack.
AI-written summary · about
chapters (12)
- 0:00API credential stuffing threats
- 1:14Speaker background and talk overview
- 3:24Why hackers target API endpoints
- 8:43How credential stuffing exploits APIs
- 12:15DraftKings attack timeline
- 21:09Attacker’s script and tactics
- 27:35Breached credentials role
- 34:15Why DraftKings attack stood out
- 38:07Fraud influencers and cash-out methods
- 40:56Defenses against API cash-out attacks
- 45:34Closing remarks
- 46:59Q&A
related talks
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
41mThe State Of Credential Stuffing And The Future Of Account Takeovers
30mTargeted Web Skimming on E-Commerce Sites
44mThe Unpatchables: Credential Stuffing Quantification and Classification
26mHack Your APIs in 15 Minutes or Less
26mAPI Abuse - Comprehension and Prevention
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs