INTERFACE by apidays 2023 - APIs & APTs: Manipulating Access in Current Events, John Hammond, Huntress

INTERFACE by apidays 2023
APIs for a “Smart” economy. Embedding AI to deliver Smart APIs and turn into an exponential organization
June 28 & 29, 2023

APIs & APTs: Manipulating Access in Current Events
John Hammond, Senior Security Researcher at Huntress

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. APIs & APTs Manipulating Access in Current Events John Hammond
3. Before we dive in: Thanks 🙂
5. In the recent weeks following the 2023 Memorial Day weekend, the cybersecurity community sprung into action to chase threats following the exploitation of the MOVEit Transfer application. Security researchers worked to analyze the attack chain, organizations worked to patch, and soon enough, the cl0p ransomware gang began to extort and blackmail victims with the threat of publishing stolen information online. One unique part of the attack chain relied on tampering with the MOVEit Transfer API -- to upload, download, and stage different files -- all through one undocumented feature. In this presentation we will dive into the technical details as to how threat actors gained access to the API, and what security implications came from it... documented or not!
6. News articles on MOVEit exploit • https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/ • https://thehackernews.com/2023/06/microsoft-lace-tempest-hackers-behind.html • • • https://digital.nhs.uk/cyber-alerts/2023/cc-4326
18. “Undocumented” authentication method!
19. https://twitter.com/_JohnHammond /status/1665898849314164736
22. Cybersecurity is teamwork.
23. Call to action: rallying cry. It’s up to us to find vulnerabilities & help fix. Even amidst APIs! 😊
24. Thank you :)
25. “Don’t Scan QR codes” Don’t be a stranger If you want to chat: j-h.io/links