apidays LIVE LONDON - The Road to Embedded Finance, Banking and Insurance with APIs API Abuse - Comprehension and Prevention David Stewart, CEO at CriticalBlue

1. APIDays London 2020
www.approov.io

2. Because they can...
API Abuse - Comprehension & Prevention

3. API Abuse - Comprehension & Prevention
Nordicapis: 5 Modern API Data Breaches
https://www.theverge.com/2020/10/22/21529477/mcdonalds-mcbroken-
bot-ice-cream-machines-app-engineering
At US Fintechs, every $1 in
fraud costs $3 in profit
Source: LexisNexis® Risk Solutions

4. An app limits the range/speed an
API can manipulate user data.
However, a bot can rapidly
manipulate and exfiltrate all your
valuable data.
API Abuse - Comprehension & Prevention
In 2018 the average cost of a data breach is
$3.86M, up 6.4% from 2017. (Ponemon)

5. API Flaw Exploitation
API Abuse - Comprehension & Prevention
Remote Client Impersonation

6. “Having completed the integration and test
in less than 30 days, we deployed the
Approov protection and instantly saw the
costs due to the fraudsters drop by 90%.”
— Emre Kenci, CTO, Papara.
https://approov.io/customer/papara

7. “When an app is capable of
being decompiled, it provides
the adversary access to
sensitive information inside the
source code, such as API keys;
API secrets; URLs that the app
communicates with, which
would allow an adversary to
then target the APIs of the
backend servers…”
https://www.fintechsymposium.com/in-plain-sight-the-insecurities-of-mobile-financial-apps.html

8. New Way: Require apps to prove that they are your live, authentic apps before
authorizing API calls.
New Result: A good solution rejects all bots and automations while not falsely
rejecting any valid app, reducing the costs of fraud in your business. Building and
maintaining your own effective solution is very expensive and very
time-consuming.
Fraud due to automated mobile traffic is growing fast in the fintech sector and
authentication of the app, not just an API key, is needed to block it.

9. If there is even a small pinhole in the
platform security, the fraudsters will
find it and exploit it. One example is
the use of Cloner Apps by end users
to have multiple instances of the
same app running on a single mobile
device. The use of Cloner Apps opens
up some pretty serious security holes,
and they should be banned in most
cases.
https://blog.approov.io/cloner-apps-playing-in-a-shared-sandbox

10. New Way: Add run time environmental and app integrity checks to
platform security.
New Result: Platform checks validate an app at installation time.
Fraudsters continually push new ways to breach platform security, so
procedures must be updated frequently in order to keep your fraud costs
low.
Frequent run time checks are how to block app tampering and block
masked fraudulent transactions which are not caught at install time.

11. “The truth is, there are no known
hacks of TLS 1. Rather, these
hackers were successful not due to
faulty TLS, but because of a lack of
software-quality processes.”
“...the main criticism facing TLS is
that it can be difficult to use safely
in real-world environments.”
“...these protocols can only be effective if they’re implemented
properly, using proven software-quality processes.”
https://www.electronicdesign.com/technologies/embedded-revolution/article/21807252/11-myths-about-tls

12. New Way: Enhance TLS security to lock down communication between
app and service.
New Result: Done right, enhanced TLS security is effective at protecting
API calls, ensuring your fraud costs drop dramatically since fraudsters
can’t get in the middle of your traffic and continue their attacks.
Enhancing TLS security blocks fraudsters from getting between your app
and your service, preventing both the design and execution of fraudulent
attacks.

13. “These days, retail and loyalty profiles contain a
smorgasbord of personal information, and in
some cases financial information too. All of this
data can be collected, sold, and traded or even
compiled for extensive profiles that can later be
used for crimes such as identity theft”
“Criminals are not picky — anything
that can be accessed can be used in
some way”
https://www.helpnetsecurity.com/2020/10/23/63-billion-credential-stuffing-attacks-hit-retail-hospitality-travel-industries/

14. New Way: Bind a specific user authentication with the specific app the
user is using, and expire these bound authentications frequently.
New Result: Fraud relying on stolen user authentication credentials will
only work with short-lived instance-specific app authentication. Assume
user and app authentication each reduce fraud by 5x. Binding them
together reduces fraud by 25x, instead of just 10x.
Combining app and user authentication chokes the scope and velocity of
fraudulent transactions.

15. “We experienced an attack against one of our API
endpoints which caused one of our key features to go
Out of Service. As a result we spent many man-days
putting in place some in-house security but we knew
this was only a band-aid and we would quickly need to
find something better.”
— Ben Levy, VP Engineering, Temi.

16. New Way: Over-the-air security updates.
New Result: Allows continuous and instantaneous updates to security
features. No need to release a new app. No friction for users. Instant cut in
fraud costs.
Over-the-air security updates allow continuous enhancement of security
capabilities against emerging threats without the need to release a new app.

17. You can reduce the costs incurred by fraudsters using your APIs by > 90%
within 30 days.
However most fintechs/insurtech think that some combination of API keys,
rate limiting, TLS/HTTPS encryption, certificate pinning and app hardening
will keep the fraudsters at bay. In reality, all of these solutions are either easy
to circumvent or don’t protect your API.
Follow the 5 step guide to properly protect your API from fraudulent traffic.

18. ● We have many years of expertise around deep
introspection of software execution on embedded/mobile
platforms.
● No-one had recognized that APIs servicing remote clients
such as mobile apps needed a new/dedicated security
paradigm.
● There was no specialist solution for protecting APIs
connecting mobile apps to backend servers, making such
APIs a significant weakness in enterprise platforms.
● We developed a solution based on existing expertise which
could protect APIs service mobile apps without requiring
storage of secrets in the apps. 2018 Mobile App Security Winner
Mobile App Development
2017 API Security Winner

19. https://approov.io/customer

20. Ensuring only genuine
instances of your
mobile app can use
your API.
API Abuse - Comprehension & Prevention

21. API Abuse - Comprehension & Prevention
Only the analytics engine notices.

22. Approov API Threat Protection
www.approov.io
@approov_io https://approov.io/resource/