Scorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
summary
Research downloads 55 Android banking, neobank and crypto apps, extracts APKs with APK Extractor and reverse-engineers them in MobSF, finding 54 of 55 apps hard-code API keys and tokens. Tests show broken object-level authorization lets an attacker change any ATM PIN and transfer funds without authenticating; outsourced code reuse expands impact to about 300 banks. Web application firewalls miss logic abuse, so inventory, API threat management, microsegmentation and pen tests are urgent.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:58Key Takeaways
- 9:38Results of the the Research
- 16:21Questions
- 25:36What Do You Think about the Honeypot Strategy
related talks
31mHow I hacked 30 mobile banking apps & the future of API Security
32mResults of Scanning the Top 45 Android Mobile Banking Apps
01h 01mPrincess of Thieves: How I Robbed 30 Banks
33mHacking and protection of Mobile Apps and backend APIs
57m(In)Security of Mobile Banking
45mI just hacked your app!
42mHack My App: Learn Flutter Security by Breaking It
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly