An Overview of API Underprotection
summary
OWASP flags “underprotected APIs” and Gartner predicts a majority of mobile breaches through 2019 exploit app–server communication. Real cases: Pokemon Go reverse-engineer shows private APIs get scraped; Instagram’s password‑reset endpoint leaks contact data via request tampering. Practical defenses discussed: rate limiting, API management proxying of backend keys, JWTs instead of static keys, TLS plus certificate pinning (bypassed on rooted devices and by available tools), and stronger options like white box cryptography, app hardening and TrustZone attestation.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:09API Transformation
- 3:03Security Landscape
- 4:09The Journey of Complexity
- 6:31Examples of Attacks
- 6:44Pokemon Go
- 10:11Reverse Engineering
- 11:10Potential Risks
- 12:57Traditional Defenses
- 14:30Rate Limiting
- 16:44OAuth2 Flow
- 18:35User Agent Flow
- 20:32API Permissions
- 21:39API Keys Software Identity
- 24:16Simple API Keys
- 26:26Attack Surfaces
- 26:45Trust Store
- 27:55Pinning
- 30:06Whitebox Cryptography
- 34:12Remote attestation
- 35:15Summary
related talks
50mAPI Abuse through Mobile Apps: New Attacks, New Defenses
31mStandard Classification: API Security Top 10 - A Beginner's Guide to Mitigation
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge- 50mAPI Abuse through Mobile Apps: New Attacks, New Defenses
01h 29mAPI Vulnerabilities and What to Do About Them
24mMobile - Your API Security Blindspot
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
39mThe API Assessment Primer