API Abuse through Mobile Apps: New Attacks, New Defenses

on YouTube ↗50m

" summary

Covers attacks on backend APIs caused by mobile apps, using a running example where two adversaries exploit weaknesses in API keys, OAuth2 flows, TLS certificate pinning, HMAC request signing, app shielding/hardening, and attestation to hijack a driver delivery app. Describes the specific technologies and defenses around mobile-client API security, and provides an overview of the unique challenges when mobile apps interact with REST, GraphQL, gRPC or streaming APIs.

AI-written summary · about

" chapters (33)

1. 0:00RSAConference 2020 San Francisco February 24-28 Moscone Center
2. 1:31The Dark API Economy
3. 2:40Mobile Apps Rely on APIs
4. 5:16Mobile Attack Surfaces
5. 7:24OWASP Security Risks
6. 7:56API Defense Objectives
7. 9:18The ShipFast Driver App
8. 10:37API Sequence for Pick Up and Delivery
9. 10:58The Ship Raider Bench and Driver App
10. 12:07ShipRaider's API Exploit
11. 12:47Initial Security Posture
12. 13:37User Authorization is not Service Authorization
13. 15:21Common API Gateway Defenses
14. 17:20API Proxy Pattern
15. 18:54Inspect the App Package
16. 20:35Obfuscate Code and Secrets in Code
17. 22:08Observe/Manipulate Communication Channel
18. 24:34Certificate Pinning
19. 26:29Pin the Channel • Generate public key fingerprint
20. 27:32Unpin the Channel
21. 29:44Block Rooting and Instrumentation
22. 31:13Nervous Product Manager
23. 31:50a: Use App-Level Message Protection
24. 33:40Defense 4b: Removing Secrets from App Package
25. 35:37Find Message Signing Secret
26. 36:55a: Improve Run-Time Defenses
27. 38:34Moving secrets and security decisions off device
28. 39:33Defense 5b: Authenticate the App Off Device
29. 43:19Attacker Pivots to a Less Secure App
30. 43:49OAuth2 Authorization Flow
31. 44:13Strengthen OAuth2 with Attested App ID
32. 44:50Authorization in Context
33. 46:03Apply What You Learn Today

" related talks

• 50mAPI Abuse through Mobile Apps: New Attacks, New DefensesSkip Hovsmith · RSA Conference 2020 DevSecOps & Application Security
• 24mMobile - Your API Security BlindspotDavid Stewart · apidays Paris 2021
• 37mAn Overview of API UnderprotectionRichard Taylor · AppSec USA 2017
• 30mAttack API ArchitectureAlvin Tam · apidays Hong Kong 2022
• 25mHow Do They Get In?! Understanding the API Attack VectorMichael Isbitski · Global AppSec US 2021 Virtual
• 38mI just hacked your app!Marcos Placona · Build Stuff 2017
• 19mProtect Your Digital Assets: Spot and Secure Open APIs QuicklyHimanshu Dwivedi · apidays New York 2023
• 33mHacking and protection of Mobile Apps and backend APIsTomáš Soukal · Fluttercon Europe 2024