API Insecurities

Silvia Puglisi - @nopressure

Hello World

My name is Silvia Puglisi. I am a software engineer and Ph.D. candidate at UPC Barcelona Tech.

I research in privacy and web science.

A web of data

In 2011, the amount of digital information created and replicated globally exceeded 1.8 zettabytes (1.8 trillion gigabytes).

 

75% of this information is created by individuals.

 

By the end of 2011, Facebook had 845 million monthly active users, sharing over 30 billion pieces of content.

Library Briefing - Library of the European Parliament - 01/03/2012

Applications and services today aim to build a sense of serendipitous discovery of people, places and interests.

Applications exchange user data through REST interfaces (most of the times) in the form of hypermedia representations of resources identified by URIs

Unfortunately Applications are not built with user security and privacy at heart.

API Insecurities

A number of privacy violations and threats can be easily spotted by looking at API calls made by devices through a simple proxy.

MITMProxy: An interactive console program allowing traffic flows to be intercepted, inspected, modified and replayed.

Let's see how this work in practice..

Classifying violations

  • Collection
  • Processing
  • Dissemination
  • Invasion

[1] D. J. Solove, “A taxonomy of privacy,” University of Pennsylvania law review, pp. 477–564, 2006.

Collection

Surveillance, interrogation or information probing.

Watching, reading, listening, recording of individual.

Inference of information

regarding individuals

Processing

Aggregation and identification of data.

Failure to provide data security.

Secondary use of data to which the user has not been informed.

Dissemination

Breach of confidentiality, unwanted disclosure and exposure of information.

Appropriation and distortion of data about people.

Invasion

Invasion is the threat of intrusion of an entity into someone’s private life and it includes acts that are said to disturb one’s tranquillity or solitude.

API Security

  • Is a matter of technological hygiene
  • Should be consider a product feature
  • Neglecting it could destroy your product*
Made with Slides.com