Revelations from Analyzing 1 Million Domains: Sensitive Data on the Web
summary
An engineer from Escape reports on a study that scanned 1 million domains to find exposed API tokens and RSA keys, uncovering over 18,000 credentials with 41% rated highly critical. The talk explains the custom web-scanning methodology, details the sensitive API data found and its potential financial impact, and presents concrete remediation strategies plus a practical API security checklist.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:48API tokens critical
- 5:58Security tools limits
- 8:47Detecting tokens in frontend
- 11:58Research methodology and results
- 13:21Statistics and leak impact
- 14:23RSA private keys exposed
- 17:54JavaScript assets leak causes
- 18:56Best practices to prevent leaks
- 20:20Scalable API security approach
- 21:23Automated external detection
- 22:27ID types and secret management
- 24:11Token management at 42
- 25:16Automation and secret rotation
related talks
29mDecoding a Decade of API Breaches: Key Learnings Unveiled
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
42mThe Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing
35mClosing Keynote Day 1 API First Hacking
57mSomething Something Security
34mThe State of Web Security
50mAttackers want your data and they're getting it from your API
39mHard to Port! - A Snapshot of the Vulnerability Landscape in 2015