The fifth annualOWASP AppSec Californiawas held in late January 2018 on the beach in Santa Monica. AppSec California is organized and run by an all-volunteer staff, and they put on a great conference — highly recommended. Besides excellent content and a chance to interact with many interesting colleagues, who wouldn’t want to hang out on the beach for a few days?
An overview of the event can be found on theAppSec California 2018 website, including links to many of the slides used during the presentations. Most presentations were video taped and are available onyou tube.
My talk on API Underprotection was given to a standing room only crowd which asked some very good questions at the end.
In the video, you’ll understand API security by following the evolution of the ShipFast courier service API, its branded backend service and mobile Android client, and its attacker, ShipRaider, used by both malicious and legitimate couriers to exploit the API for their own ill-gotten gains.
API User and Abuser
We start with static API keys and OAuth2 user authorization, discussing API security threats and how to counter them. Along the way, TLS, certificate pinning, HMAC call signing, app hardening, white box crypto, and app attestation are considered to strengthen your API security posture, but ShipRaider will be working hard trying man in the middle attacks, app decompilation and debugging, exploit frameworks, and other reverse engineering techniques to keep stalking you.
It’s a fast-moving overview of the cat and mouse API protection problem on mobile and provides a sense of emerging tools and techniques which enable a significant step change in API security as well as illustrating why user authentication is not enough.