Issue 176: Case study of API vulnerabilities, Riverbed vulnerability, API abuse, JWT safety
Brief
This week, we have an excellent write-up on a case study of API vulnerabilities, an API vulnerability in Riverbed’s SteelCentral AppInternals software, an article on how even the most “perfect” APIs can be abused, and a guide on the safer handling of JSON web tokens (JWTs).
Vulnerability: A case study of API vulnerabilities
This week, a popular article has been the write-up on a series of related API vulnerabilities discovered during a recent assignment by the Irish security researcher @pmofcats . The article is a real eye-opener for API defenders and developers alike to realize how easily their APIs can be compromised by a talented and determined attacker.
As the old adage goes: a chain is only as strong as its weakest link, and this write-up shows how easily a system can be compromised totally by relatively minor weaknesses.