Princess of Thieves: How I Robbed 30 Banks
summary
Claims successful compromise of about 50 mobile banking and crypto apps, exposing hard‑coded production keys and credentials and leaving BOLA (broken object level authorization) wide open; methodology combines static analysis with MobSF, MITM interception using Burp Suite and mitmproxy, then fuzzing with Kite Runner/ffuf and scripted requests in Postman and spreadsheets; practical results include changing customer PINs and transferring funds, impacting roughly 123 million accounts and ~$269B in assets.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 1:27APIs in financial systems
- 3:11Speaker background
- 6:16Hacking 30 banks
- 8:27API vulnerabilities found
- 11:18What is an API
- 12:00BOLA vulnerability explained
- 14:09Financial institutions targeted
- 16:56Hard-coded secrets in apps
- 17:37Hacking tools used
- 21:33Mobile app testing with MobSF
- 23:39Command-line tools matter
- 26:46Staging servers risks
- 29:15Hacker programming skills
- 30:40Real attack: PIN code changes
- 31:01Lessons from bank robberies
- 32:46Asset catalogs importance
- 33:48WAFs insufficient for APIs
- 34:52Outsourcing API risks
- 36:58Pen testing production APIs
- 38:28OWASP API Top 10 contributions
- 39:13Contact info QR code
- 40:14Q&A
related talks
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
31mHow I hacked 30 mobile banking apps & the future of API Security
58mHow I used to rob banks!
57m(In)Security of Mobile Banking
35mHow I Handled One of the Biggest Banking Fraud Incidents of 2020
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
46mThe Art of Cyber Espionage: Unleashing the Power of SCADA and ICS Hacking
51mModern Bank Heists