API = Authentication’s Poorly Implemented
Talkat AppSec California 2015 · on Tuesday, 2015-01-27· at 14:45· Annenberg Community Beach House: Track 1, 415 Pacific Coast Hwy·
summary
Real examples and fixes matter: a PayPal 2FA bypass arises from a legacy SOAP endpoint accepting primary credentials while the REST API enforces TFA, a vulnerable IoT camera transmits MD5 passwords and no TLS, several services leak session token reuse in JSON responses, and a toy messaging app trusts client-reported credits enabling free stamps. The useful bits are exact request/response fields, the tools and IDLs tried (Swagger/WADL), how tokens are generated or misvalidated, and whether patched fixes actually stop exploitation.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:54The Legacy Api Integration
- 6:29Bug Inheritance
- 7:51Client-Side Enforcement
- 10:11Information Exposure
- 15:02Multi-Site Feature of Wordpress
- 16:41Savage Shared Credentials
related talks
46mFixing authentication and authorization
18mSecure your Apps and APIs with strong authentication and Adaptive Access.
30mInsecurity protocols: an overview of modern authentication
08mAPI Security Risks
01h 00mSEVEN things about API security
56mSEVEN things about API security
53mGetting API Security Right
30mAttack API Architecture