Attackers want your data and they're getting it from your API
summary
Includes packet capture and proxying — Wireshark and mitmproxy — to reveal plain and MITM‑decrypted traffic, decompilation of Android apps and GitHub searches that surface ~7M leaked API keys, and concrete incidents: Google Plus ~50M exposed profiles and T‑Mobile ~2M impacted users. Covers auth tradeoffs: certificate pinning, JWT + refresh tokens and their revocation limits, rate limiting, WAFs, and practical hardening like HMAC request signing and API gateways that proxy and rotate secrets.
AI-written summary · about
chapters (6)
- 0:00Start
- 6:14Code bugs everything else
- 24:10Token Authentication
- 34:46Getting the (client side) signing key
- 35:46Make the signing key dynamic
- 46:42Questions
related talks
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
45mI just hacked your app!
25mHow Do They Get In?! Understanding the API Attack Vector
50mA Tour of API Underprotection
37mAn Overview of API Underprotection
35mClosing Keynote Day 1 API First Hacking
45mI just hacked your app!
44mI just hacked your app!