Mobile - Your API Security Blindspot
summary
Mobile is an API security blind spot: attackers build scripts that bypass apps and call rich APIs directly, using emulators, device farms and instrumentation tools like Frida or Exposed to unpin TLS and manipulate runtime behavior. Common attacks seen are credential stuffing, fake account creation and large-scale scraping. Effective defenses combine app integrity checks (attest every few minutes), granular device integrity signals, and dynamic certificate pinning delivered over the air so revoked or rotated certs don’t require app updates. The key question: can the backend distinguish script traffic from genuine app instances?
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:35API Architecture
- 5:40Mobile Security
- 6:50How it all works
- 7:53The bottleneck
- 8:55The simplistic view
- 10:26Mobile device
- 11:33Channel
- 13:02Scripts
- 15:30Authentication
- 16:47Device Integrity
- 18:25Certificate Printing
- 19:30Recommendations
- 21:32Resources
related talks
50mAPI Abuse through Mobile Apps: New Attacks, New Defenses- 50mAPI Abuse through Mobile Apps: New Attacks, New Defenses
21mSecuring the Unseen: Advanced Threats, Best Practices & Challenges in Mobile App Security
33mHacking and protection of Mobile Apps and backend APIs
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
33mBest Practices for Mobile App Security Testing
21mWhen Attackers Go Mobile-First: What Developers Need to Know
37mAn Overview of API Underprotection