Secure React Native Apps Against API Abuse

on YouTube ↗45m

" summary

React Native app reverse engineers reveal an exposed API key in unminified JS bundle and a proof‑of‑concept modified app that loops the getNearestShipment call to harvest lat/long and gratuities so drivers pick high‑paying jobs; mitigation includes JS obfuscator, TLS certificate pinning, blocking rooted devices and detection with geomonkey, but attackers use Frida instrumentation to bypass pinning. Countermeasures evolve to app‑level HMAC signing and an attestation service issuing short‑lived signed tokens validated by the backend; measures reduce but do not eliminate risk.

AI-written summary · about

" chapters (29)

1. 0:00Intro
2. 1:49The Dark API Economy
3. 2:40Mobile Apps Rely on APIs
4. 3:39Abusing APIs in the Mobile Market
5. 5:58Mobile Attack Surfaces
6. 8:22The ShipFast Driver App
7. 9:17API Sequence for Pick Up and Delivery
8. 9:51The Ship Raider Bench and Driver App
9. 10:40ShipRaider's API Exploit
10. 11:25Initial Security Posture
11. 12:05User Authorization is not Service Authorization
12. 12:53Common API Gateway Defenses
13. 14:32API Proxy Pattern
14. 15:56Inspect the App Package
15. 17:24Obfuscate Code and Secrets in Code . Obfuscate calling logic and API & kay strings
16. 19:01Observe/Manipulate Communication Channel
17. 20:36Certificate Pinning
18. 23:50Unpin the Channel
19. 26:03Block Rooting and Instrumentation
20. 27:12Nervous Product Manager
21. 28:02a: Use App-Level Message Protection
22. 30:07Defense 4: Removing Secrets from App Package
23. 31:26Find Message Signing Secret
24. 32:49a: Improve Run-Time Defenses
25. 34:33Moving secrets and security decisions off device
26. 37:09Defense 5b: Authenticate the App Off Device
27. 39:59Defense 5c: Reintroduce the Pinning Service
28. 41:31API Defense Objectives
29. 43:15Attacker Pivots to a Less Secure App

" related talks

• 50mA Tour of API UnderprotectionSkip (unknown) · OWASP AppSec California 2018
• 33mHacking and protection of Mobile Apps and backend APIsTomáš Soukal · Fluttercon Europe 2024
• 45mI just hacked your app!Marcos Placona · Voxxed Days Zurich 2017
• 26mInfiltrate Your Own Expo/React Native AppWouter Van Den Broek · App.js Conf 2022
• 23mTopics of Interest: React Native Security. Addressing typical mistakesJulia Potapenko · OWASP 20th Anniversary 2021
• 24mMobile - Your API Security BlindspotDavid Stewart · apidays Paris 2021
• 36mI just hacked your app!Marcos Placona · GDG DevFest Ukraine 2017
• 50mAPI Abuse through Mobile Apps: New Attacks, New DefensesSkip Hovsmith · RSA Conference 2020 DevSecOps & Application Security