on schedule here so the first speaker wins the creative award for the best title for this
session: Sherlock Holmes in the Cryptic Case of API Security
What what's going on here??
We are following breaking news there has been a data security breach at the popular investing site
Robin Hood more than seven million Experian application programming interface on a student
loan vendor's website allowing any user to look up the credit score of hundreds of millions of
Americans by supplying simple information and this API required no authentication whatsoever
while excluding the breach involving the networking site LinkedIn and this
sector was reportedly investigating a data breach involving up to a hundred
million customers 20 million people who applied for t-mobile credit was stolen
platform twitch says a malicious third party is behind a massive data breach of the website
private information including names addresses and driver's license numbers of Californians who were
granted or denied a concealed weapons permit between 2011 and 2021. Microsoft is announcing
that it's found another wave of attacks by the Russian intelligence service that is actually
communal report says 2021 saw a record number of cyber attacks of 68 140 million consumers were
compromised by hackers that are still unidentified the data also contains addresses of hundreds of
defense sites and navy missile maintenance unit bombing ranges there were also weapon storage
All right, ladies and gentlemen, I ask that you please remain in your seats as this has
now been designated an API crime scene. Please try not to touch or contaminate any of the
evidence you might come across as we're going to be moving very quickly to solve this case.
My name is Brenton House and I'm the lead detective on this case.
I am also an ex-hacker, developer, architect, filmmaker, and digital evangelist at Software AG.
Now... if I look at my notes, I see that this is the group that
has volunteered to help me on this case so let's get started.
All right in the next 15 minutes, we're going to solve a real-world
case. We're going to do that by applying three principles from Sherlock Holmes.
We're going to determine what happened and what could have been done to prevent this.
Now it's very important that you remember these three principles because
there will be an exam later.
So the first principle is Knowing your Resources.
Sherlock holmes always knew who and what was available to him as a resource.
He had contacts in the police department and pretty much every other community.
He took advantage of these resources and he then leveraRged them he could then
leverage the resources to be able to find who and what could help him solve a crime.
Each resource might be different for each situation but he had to use that judgment
First, we had to Know your Resources.
Second, we have Know your Situation.
Sherlock Holmes once said: "I've trained myself to see things that others overlook"
Sherlock Holmes is known for his keen sense of observation and deduction
but in order to see all the clues that were available to him he had to hone those skills.
So he observed everything that was in the world around him. He would then use this information
to make educated deductions based on facts ,data, and on patterns.
Okay. So number one, We had Know your Resources.
Two, we had to Know your Situation.
and Three, we have Know your Adversary.
Sherlock Holmes was always quick to learn as much as possible about who he was up
against whether that was his arch-nemesis, Professor Moriarty, or a common criminal.
He would study their methods, their tools, their weapons, and their thought processes.
So we have Resources, Situation, and Adversary.
If it helps you remember acronym:RSA then go ahead and use that.
All right before we can take a look at this case together I need everyone to take the shock homes
API detective examination now I've been told that you are the best and the brightest here in hub 2,
so I'm going to need you to speak your answers clearly and loudly so that
everyone in hub 1 and 3 knows that hub two rocks.
All right so we have: Know your...
okay i'm not sure the guy in the back of the room could hear you guys let's try it again
know your all right excellent next know your great and know your
okay great job you guys definitely live up to your reputation so let's take a look at this case
so the case that we're going to look at today is a peloton api breach
so in january of 2021 a security researcher discovered that an
unauthenticated user could access the peloton api and gain access to
user data for any user including those that had their profile marked as private
so the data that was exposed include user ids instructor ids
workout information uh geolocation age gender and more
let's take a quick look at the timeline
so first the vulnerability was discovered and it was reported to peloton using the official
peloton reporting tool it was also they were given the standard 90-day window to address the
issue before it would go public next thing that happened was well nothing peloton didn't respond
publicly or privately to the researcher next after a couple weeks api was quietly quo fixed and what
i mean by that was now the api was only accessible by those that had that were authenticated now
can anyone tell me really quickly why that's not a fix
well if the authentic if the app if the api was required authentication but not authorization
policy so any authenticated user could get into the api but then still access data for
any other user so again peloton was notified that their fix didn't work and the next was after the
90-day window peloton the press was notified press went to peloton then peloton started responding
after a couple weeks the api was then secured and
pelton performed a public disclosure but by that time so much damage had been done all right
let's apply the three principles that we just learned to this case first is know your resources
now there are a lot of api security resources out there there are great websites there are great
videos and youtube channels but most importantly there is the owasp top 10 list for api security
now the os top 10 list for api security includes the top security vulnerabilities for apis
this is going to be an essential tool kit for your api security strategy
okay so let's take a look at the peloton api case using this list
we can see that they had broken object level authorization broken user authentication and
excessive data exposure at the very least there may have been more what that means
simply is that they didn't check who you were they didn't check that you had permissions to
do what you wanted to do and three they were sending way too much information
in peloton's case they were sending personal information about private users
next is know your situation situational awareness with api security is so important
you have to know what different types of apis are out there but you also have to
know what apis you have what you're consuming and what you're producing
you also need to know what your api cyber security stat
strategy is now for most organizations cyber security is a priority however for a lot of
cisos and cyber security experts api security is a gap for them case in point the peloton api so
when president biden decided that he was going to bring a peloton bike into the white house a group
of cyber security experts came together to look at the situation they analyzed the situation they
looked at the bike locked it down and assured everyone that was completely safe because this
could not be hacked into obviously their api security was a gap because an unauthenticated
user could go in and see the data for any user including the president of the united states
all right i already said that there's a lot of different types of apis we have public external
open internal partner machine to machine third party apis
composite and then your beta and testing now if we look at the peloton case you can see
that they were using a machine to machine api which is common with iot devices and servers
but this type of api is often neglected with api security when compared to the other types of apis
but these are not the only types of apis that exist out there
there are also unknown apis such as shadow apis and those are apis you try and keep off the radar
zombie apis and those apis work great but they haven't been updated in forever and are missing
critical security patches and frankenstein apis and those are apis are hacked together they can
be public or internal but it's because they want to access data from a system whose api
is either incomplete or non-existent so again if we look at the peloton case we can see that it's
kind of a former shadow api because they tried to keep this api off the radar and undocumented they
also tried to use something which is often called security by obscurity which we know doesn't work
all right now this is where the rubber meets the road
know your adversary with api security is important that you are able to get into the mind
of your adversary if you are going to properly manage and secure your apis
i'm going to start with some blue team defensive tools here
you have your api gateway now this is so important this is going to be the
core and foundation for your api security everything is going to be based on this
you also have web application firewalls or wafts these provide an additional layer of
protection using artificial intelligence and machine learning
and you also have other api security tools and these are typically dedicated
api security tools that can be used to provide your shift left features which help you at design
time and development and your shield write features which protect your api at runtime
now there are also red team offensive tools now i'm not going to go into details on a lot
of these tools but i will tell you this you need to have an understanding of what tools could be
used by someone to gain access to your apis or just to discover vulnerabilities in your apis
it's worth your time to at least know what these tools are and how they work
so we looked at knowing your resources knowing your situation and knowing your
adversary but there's also a bonus and that is knowing where you're going your api strategy
your api security strategy that you have is very important you also need to know where
your gaps are not just in your security but in your knowledge of api security keep
learning so continue your api cyber security learning journey by learning wherever you can
but it's important to know what you don't know now i have a uh api cybersecurity 101
series out on youtube you can find that at youtube.com forward slash brenton house
but also check out there's a api shorts youtube channel and the software ag youtube channel
there are also some great web resources out there and i highly suggest you take a look
at api security dot io so colin has a fantastic newsletter and website that really helps people
stay up to date on the changing world of api security you can also check out my
website at brenton.house and also check out softwareag.com to learn about the products
and the tools that can help you securely manage your apis
all right we learned a lot by looking at the peloton case through the eyes of sherlock holmes
we learned about knowing your resources knowing your situation
knowing your adversary but also about knowing what you know now i appreciate everyone's help
in solving this case and i look forward to solving our next case together if you want to get in touch
with me at all you can feel free to connect with me on linkedin and send me a message there as well
and i believe we might have time for um for any questions or we also have a giveaway here
you