API Abuse through Mobile Apps: New Attacks, New Defenses

on YouTube ↗50m

" summary

Covers how mobile apps introduce new API attack vectors by demonstrating exploit techniques against a delivery app—examples include stealing or bypassing API keys, abusing OAuth2 user authorization, defeating TLS certificate pinning, attacking HMAC call signing, and bypassing app shielding/attestation. Uses a concrete red-team-style scenario (Shipfast vs ShipRaider) to show how these mobile-specific vulnerabilities affect API infrastructure and outlines defensive considerations for protecting APIs accessed by Android/iOS clients.

AI-written summary · about

" chapters (33)

1. 0:00RSAConference 2020 San Francisco February 24-28 Moscone Center
2. 1:31The Dark API Economy
3. 2:40Mobile Apps Rely on APIs
4. 5:16Mobile Attack Surfaces
5. 7:24OWASP Security Risks
6. 7:56API Defense Objectives
7. 9:18The ShipFast Driver App
8. 10:37API Sequence for Pick Up and Delivery
9. 10:58The Ship Raider Bench and Driver App
10. 12:07ShipRaider's API Exploit
11. 12:47Initial Security Posture
12. 13:37User Authorization is not Service Authorization
13. 15:21Common API Gateway Defenses
14. 17:20API Proxy Pattern
15. 18:54Inspect the App Package
16. 20:35Obfuscate Code and Secrets in Code
17. 22:08Observe/Manipulate Communication Channel
18. 24:34Certificate Pinning
19. 26:29Pin the Channel • Generate public key fingerprint
20. 27:32Unpin the Channel
21. 29:44Block Rooting and Instrumentation
22. 31:13Nervous Product Manager
23. 31:50a: Use App-Level Message Protection
24. 33:40Defense 4b: Removing Secrets from App Package
25. 35:37Find Message Signing Secret
26. 36:55a: Improve Run-Time Defenses
27. 38:34Moving secrets and security decisions off device
28. 39:33Defense 5b: Authenticate the App Off Device
29. 43:19Attacker Pivots to a Less Secure App
30. 43:49OAuth2 Authorization Flow
31. 44:13Strengthen OAuth2 with Attested App ID
32. 44:50Authorization in Context
33. 46:03Apply What You Learn Today

" related talks

• 50mAPI Abuse through Mobile Apps: New Attacks, New DefensesSkip Hovsmith · RSA Conference 2020: Mobile & IoT Security
• 24mMobile - Your API Security BlindspotDavid Stewart · apidays Paris 2021
• 25mHow Do They Get In?! Understanding the API Attack VectorMichael Isbitski · Global AppSec US 2021 Virtual
• 50mA Tour of API UnderprotectionSkip (unknown) · OWASP AppSec California 2018
• 37mAn Overview of API UnderprotectionRichard Taylor · AppSec USA 2017
• 38mI just hacked your app!Marcos Placona · Build Stuff 2017
• 33mHacking and protection of Mobile Apps and backend APIsTomáš Soukal · Fluttercon Europe 2024
• 30mAttack API ArchitectureAlvin Tam · apidays Hong Kong 2022