Snapchat No authentication, no rate-limit Gibson security Facebook Graph API Improper authorization check; users can delete other user’s photos Programmable Web IRS Get Transcript API IRS Instagram Passwords stolen Daily Dot Tesla Model S Dictionary attack on password Security Affairs Nissan Leaf VIN number as security credential on API TroyHunt T-mobile No validation of access token Motherboard Wordpress REST APIs Allowed unauthenticated access csoonline.com Buffer Compromised third-party password; Oauth secret in github Programmable Web Ref: https://apigee.com/about/blog; https://www.csoonline.com/article/3176028/data-breach/february-2017-the-month-in-hacks- and-breaches.html; https://www.programmableweb.com/news/facebook-fixes-huge-api-security-vulnerability/2014/07/15 Similar Trends in API Security
Observed that the entire database of content could be easily downloaded by incrementing ids for a well- known financial blog website. Been Hacked Wordpress personal site got hacked because of generous file permissions. Reverse Engineering HTTP Proxy/Monitoring tools make it very easy to reverse engineer native apps. Access Restricted Content Observed that all songs (mp3 files) could be downloaded via the API for a popular subscription-based Indian music app. Personal Experience
Today My company is too small and it won’t happen to me Why spend time and money on a problem we don’t have Get the product out now and deal with security in v2
integrity, and availability are three key factors used in benchmarking security systems. Design Patterns Covered Addresses following security properties: 1. Authentication: Validating identity • Something you know, are, have 2. Authorization: Validating actions 3. Availability: Protecting itself from threats 4. Auditing: Addressing the threats proactively and reactively Facilitates choosing/implementing right strategy API Security Objectives
for enforcing access. 2. Client adds HTTP header with credentials encoded in base64 (note: not encrypted) 3. API Keys are best for two things: identification and analytics. 4. Used by JIRA, Wordpress. Basic Authentication GET / HTTP/1.1 Host: example.org Authorization: Basic Zm9vOmJhcg==
access delegation protocol Hotel check-in Present proof of identity via driver’s license and provide credit card. Validate identity Use that to confirm who you are and lookup your reservation, account information etc. Issues Keycard Once validated successfully, they issue a keycard Access to Room Keycard has information encoded which lets you into your room only. Access to Amenities Also gives access to pool, gym etc. OAuth2.0
used to provide structure to tokens. • Can be used to prove the authenticity of the source of data. data = base64urlEncode(header)+ “.” + base64urlEncode(payload) “.” + base64urlEncode(cryptographicParameters) signature = Hash(data, secret); JWT = data.signature JSON Web Token (JWT)
overhead and decentralized verification. b. Adopted widely Cons a. Secret can be compromised. b. Added complexity in client-side implementation. Ref: https://jwt.io JSON Web Token (JWT)
popular technique to identify threats associated with a system in a methodical manner. Threat Modeling Ref: Threat Modeling: Designing for Security 1st Edition by Adam Shostack Security Properties Threats Authentication Spoofing Integrity Tampering Nonrepudiation Repudiation Confidentiality Information disclosure Availability Denial of Service Authorization Escalation of privileges
Graph API security model that leverages Oauth 2.0 Putting it all together: Facebook Web Browser Application Auth Server Content Server FB Authorization Code FB Authorization Code Access Token Access Token + Request for protected resource Protected resource Protected resource Protected resource Request
Graph API security model that leverages Oauth 2.0 Putting it all together: Facebook Web Browser Application Auth Server Content Server FB Authorization Code FB Authorization Code Not authorized Resource: Not available Resource: Not available Request
proof is a sha256 hash of your access token, using the app secret as the key. $appsecret_proof= hash_hmac('sha256', $access_token, $app_secret); Facebook API to get facebook user details : https://graph.facebook.com/v2.2/me?access_token=EAACPRRovJsoBAM FjS9KMLYz2p9CPy6A1&appsecret_proof=43bb024d&fields=name%2Cfirst _name%2Clast_name%2Cemail%2Clink%2Cgender%2Clocale%2Cpicture Securing Server-side calls: appsecret_proof Ref: https://developers.facebook.com/docs/facebook-login/security#checklist
1. Login sets a cookie for auth token. 2. Validity for 30 minutes from time of login 3. Auth token is passed into subsequent requests 4. nc/x-udid = nonce to assist auditing 5. Protection against CSRF
Approach Lesson 1 Problem: Microservice Heterogeneity 1. Different security mechanisms per microservice. 2. Adds complexity on the client-side code. Solution: Dedicated Trust Server
all abstractions for security mechanisms. • Enforces best practices. Tradeoffs: • Gatekeeper for every request to every Microservice APIs. • Minimal RTT response times and must scale. • Heavily monitored with failover capability. High ROI: Foundation for new Microservices. Takeaway: Dedicated Trust Server
at a cost Psychological Acceptability Usability in Security Lesson 2 Security mechanisms should not make the resource more difficult to access than if the security mechanisms were not present. • It is the users that bear the cost. • A good security mechanism is right balance between security and the user comfort. Security Comfort
of the data exposed via the API. 1. PCI: Credit card, personal, financial or medical information of an user 2. PII: Content generated by the user, not shared publicly 3. Publicly Known Information 2.Analyze traffic patterns 1. High traffic. 2. Low-Medium traffic. High Traffic Low Traffic PCI Tier2 Tier1 User Specific Content Tier 2 Tier 1 Publicly Known Tier 3 Tier 2 Takeaway: Hierarchical Security Model
How long an access token is valid for 2. ReadWrite Scope: Defines which methods are allowed 3. Failure Threshold: Bypass if dedicated trust server doesn't respond within threshold. Token Lifetime ReadWrite Scope Failure Threshold Tier 1 One-time Read-write 60s Tier 2 One-time Read-only 300s Tier 3 24 hours Read-only 100ms Takeaway: Hierarchical Security Model More Secure Less Secure
Lesson 3 1. Client secrets are statically stored on the app. § Online tool that looks for secrets: https://android.fallible.co/# § Used for obtaining initial access token, refreshing tokens (or for every call) 2. Leverage code obfuscators: not granular enough
to store client secrets(RFC 7636) 2. Extension for Oauth 2. 3. CodeVerifier is high-entropy random string 4. CodeChallenge is transformed codeVerifier using challengeMethod 5. Used plain challenge method to handle backwards compatibility Takeaway: Implementing PKCE
to store client secrets(RFC 7636) 2. Extension for Oauth 2. 3. CodeVerifier is high-entropy random string 4. CodeChallenge is transformed codeVerifier using challengeMethod 5. Used plain challenge method to handle backwards compatibility Takeaway: Implementing PKCE abc sha256 sha256(abc)
learnt lead us to this comprehensive security . 2. Adopted the simplified Oauth 2.0 flow with OpenId Connect. 3. Dedicated Trust Server introduces abstraction. 4. Dynamic Secret Sharing ensured authenticity of the client apps. 5. Rate limiting and monitoring usage by each client. Takeaway: Overall Security Model
Model User App Server Auth Server API Generates Code Verifier Authorization Request + CodeChallenge + ChallengeMethod Request OIDC Auth Request ID Token + Access Token Auth Code
always worth to spend time and energy for security. § Choosing the right security protocol and combining it with right data protection techniques is the key to secure web service. § It’s a constant battle. Conclusion
amritajain
y0hgi
nttcom
nealle
sh_fk2
satoshi7
namiki64
jyouryuusui
daidaidai
.png){kind=avatar}
yamad
prog893
ymotongpoo
yazm
stuffmc
rkendrick25
skipperchong
vanstee
jlugia
jacobian
holman
matthewcrist
marcduiker
maggiecrowley
danielanewman
reverentgeek
