Issue 152: Exposed API keys and tokens, SAST/DAST for API security testing, the value of API specifications
Brief
This week, we have a breach involving exposed API keys for payment integration, leaked API tokens on Travis CI, the shortcomings of static and dynamic application security testing (SAST/DAST) for API security, and the value that API specification frameworks bring.
Breach: Exposed payment integration API keys
The big news story this week was the leakage of API keys for payment integrations that potentially exposed transaction details and personally identifiable information (PII) of millions of users.
CloudSEK, the maker of artificial intelligence-enabled digital threat protection, revealed that many mobile applications have API keys hard-coded into the application packages. This is security by obfuscation, because a hacker could easily recover such tokens, using just basic reverse engineering skills.