All our APIs are belong to us
summary
Snapchat reports running 140 security reviews and 550 privacy reviews in 2015 while fighting third-party apps that harvest credentials. Defenses include deprecating old APIs, rejecting nonstandard user agents and malformed headers, push-token tricks (that Android quickly circumvents), Android SafetyNet attestation, and embedding white-box cryptography to sign requests server-side. Account locks and staged warnings enforce policy. Remote signing farms remain the active bypass and the cat-and-mouse game continues.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:38Overview
- 1:27Snapchat
- 3:29HackerOne
- 5:41What is the problem
- 7:03Thirdparty apps
- 8:33Example
- 8:50Risks
- 11:05Spam and Abuse
- 13:08ThirdParty App Abuse
- 14:28Solution 1 Server Side Only
- 15:13Establish a Baseline
- 17:39Press
- 18:12Mobile notifications
- 20:31iOS notifications
- 23:33Serverside analysis
- 25:35Handling abuse
- 29:02Android ID token
- 30:35Android ID token abuse
- 32:42Android Safety Net
- 38:04pitfalls of code obfuscation
- 42:03Current challenge
- 42:48New twist
- 44:09More abuse
- 45:31Hiring
related talks
24mMobile - Your API Security Blindspot
42mA MORE SECURE WORLD FOR ANDROID APPS
37mAn Overview of API Underprotection
46mA More Secure World for Android Apps
24mModern Android App Security: Protecting Code, Keys, and Data
52mGetting API security right
39mAndroid App Security Fundamentals
01h 02mApisecure, 14 & 15 March 2023 - Ted Miracco, CEO at Approov & Attestation.