Issue 197: Apps leaking Twitter tokens, parameter smuggling attack in Golang, API catalogs for security
Brief
This week, we have two vulnerabilities — the first is the revelation that thousands of applications are leaking Twitter access tokens, and the second is a parameter smuggling attack in Golang affecting some well-known Golang-based projects.
We also have an article on the benefits of API catalogs in delivering security benefits and, finally, a fascinating read on everything you could ever want to know about rate limiting.
Vulnerability: Thousands of applications leaking Twitter access tokens
Security researchers at CloudSEK this week disclosed the details of 3,200 mobile applications potentially leaking Twitter API keys. The researchers discovered that in many cases, developers had embedded Twitter API keys within their application binary or manifest, which would allow attackers to extract the keys and use them to access Twitter as if they were the application user.