REST in Peace: A Journey Through API Protection
summary
Backend team observes thousands of calls to public endpoints and shows HTTPS plus static API tokens still leak. A demo app and scripts prove interception via Charles proxy, string recovery with APKTool/JADX, and runtime extraction of decrypted tokens using Frida hooks even after adding client-side encryption and pinning. Conclusion: no perfect fix, layered defenses (certificate pinning, harder-to-reverse crypto, anti-tamper/dynamic-analysis detection) push an attack from minutes to days; code and examples are on GitHub for reproduction.
AI-written summary · about
chapters (8)
- 0:00Introduction to API security
- 1:11Business impact of API misuse
- 3:15Proxy attacks and certificate pinning
- 5:23Static analysis risks
- 7:10Runtime decryption attacks
- 10:02Token removal limitations
- 11:26Raising the bar for protection
- 13:11Closing thoughts and Q&A
related talks
50mA Tour of API Underprotection
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
50mAttackers want your data and they're getting it from your API
39mAPI = Authentication’s Poorly Implemented
37mAn Overview of API Underprotection
01h 00mSEVEN things about API security
44mAll your APIs are mine - Secure them now
39mThe API Assessment Primer