A Tour of API Underprotection
summary
A demo shows a delivery app and an attacker web tool called ShipRaider web app that finds a leaked API key in manifest of an Android APK, uses it to call a radius-search API, and profits from big gratuities. Simple TLS is enforced but attackers bypass pinning with tools like SSL TrustKiller; HMAC signing and XOR obfuscation are defeated by runtime breakpoints. A deployed fix uses a dynamic attestation service plus short-lived tokens and a proxy pattern, and so far it stops ShipRaider.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:52ShipFast Delivery Service
- 2:33Client Complexity Spurs API Growth
- 7:46Ship Raider Shipper's Edge
- 10:16Transport Layer Security
- 10:48Man in the Middle Attack
- 11:45Certificate Pinning
- 12:20Pinning Upkeep
- 15:15Rate Limiting and Load Shedding
- 16:29Behavioral API Security
- 17:32Add Request Signing
- 19:16App Hardening Approaches
- 21:48Calculate Secret at Runtime
- 22:57How They Broke the HMAC
- 23:51OAuth2 Overview
- 24:53Abstract Protocol Flow
- 25:47Outh2 Code Grant Flow
- 28:36OAuth2 Proof of Key Code Exchange (PKCE)
- 30:41Multiple API Services
- 30:59API Proxy Pattern
- 32:31App Integrity Measurement
- 34:58Dynamic Pinning
- 35:50Strengthening OAuth2 Flow
- 37:21Architecture Pattern
- 40:55Conclusion
- 41:33Additional References
related talks
50mAPI Abuse through Mobile Apps: New Attacks, New Defenses
21mBecome a hero to your DevSecOps team
14mREST in Peace: A Journey Through API Protection
50mAttackers want your data and they're getting it from your API
37mAn Overview of API Underprotection
24mMobile - Your API Security Blindspot
45mI just hacked your app!
33mHacking and protection of Mobile Apps and backend APIs