The Reasoning Show Trends in API Security
11 snips
Aug 9, 2023 API security trends and breaches are discussed. The guest, Filip Verloy, talks about his background in API security. Common problems faced by organizations and the role of APIs in breaches are explored. The chapter on AIML in API security is also highlighted.
AI Snips
Chapters
Transcript
Episode notes
APIs Frequently Power Major Data Breaches
- APIs are often the hidden root cause of high-profile data breaches rather than the named company product itself.
- Examples include the MoveIt attack (SQL injection + API deserialization) and Optus exposing an unauthenticated API that leaked millions of records.
MoveIt Showed Chained SQL Injection And API Abuse
- The MoveIt incident combined a zero-day SQL injection with API deserialization abuse in a second-stage exploit.
- Attackers leveraged trusting deserialized API inputs to achieve remote execution or data theft, as described in Noname's blog.
Optus Leak Came From An Unauthenticated Public API
- Optus leaked millions because an unauthenticated API was exposed to the public internet that the company didn't know was reachable.
- Attackers could query the API directly with no authentication and extract millions of identity records.