Issue 155: Vulnerability in BrewDog mobile app, APIClarity at KubeCon, API attacks in Open Banking
Brief
This week, we have a vulnerability in the BrewDog mobile app exposing users’ PII courtesy of hard-coded bearer tokens, Cisco has announced the arrival of their APIClarity at KubeCon 2021, F5 has published a report on API attacks in Open Banking, and finally, there’s a mega-guide on API security best practices.
Vulnerability: Hard-coded API bearer token in BrewDog mobile app
The big news item this week is the vulnerability in the BrewDog mobile app disclosed by Pen Test Partners. This vulnerability has potentially exposed the personal details of over 200,000 ‘Equity for Punks’ shareholders over the last 18 months. It is currently unclear if the vulnerability has been exploited, but it certainly is not insignificant in its potential impact.
The researchers discovered that the developers of the mobile app had hard-coded API bearer tokens into the application source code.