APPSEC-PARLER-2021

On 8 August 2019 Pen Test Partners (researcher Alex Lomas) publicly disclosed that the 3fun dating app, which claimed about 1.5 million users, was leaking the precise location and private profile data of its users. The app collected real-time GPS coordinates and let users hide their location, but that privacy setting was enforced client-side only, hidden purely in the mobile app interface. The server's API endpoint still returned each user's exact latitude and longitude plus private profile data including dates of birth, sexual preferences, chat information and private photos stored in Amazon S3, regardless of the user's privacy settings. Because an attacker could spoof arbitrary coordinates and read raw coordinates directly from the response, no trilateration was even necessary, and Pen Test Partners located users at the White House, US Supreme Court and 10 Downing Street. This is a classic Excessive Data Exposure flaw, the read side of Broken Object Property Level Authorization (OWASP API3:2023), where the server returns sensitive object properties the client should never receive and relies on the client to filter them. 3fun pushed a fix roughly a week after notification.

On January 19, 2023 T-Mobile disclosed in an SEC 8-K filing that an attacker had abused a single API to obtain data on roughly 37 million current postpaid and prepaid customer accounts, with access beginning on or around November 25, 2022 and continuing about six weeks until detection on January 5, 2023 and cutoff a day later. The exposed fields included names, billing addresses, emails, phone numbers, dates of birth, account numbers, and plan features; T-Mobile stated no passwords, payment card data, Social Security numbers, or government IDs were taken. T-Mobile only stated that a bad actor obtained data through a single API without authorization, without publishing the low-level mechanism; the security-community consensus reconstruction is Broken Object Level Authorization (BOLA/IDOR), where the API returned per-customer records without verifying the caller was authorized for that specific object, letting the attacker walk through customer identifiers at scale. The mechanism maps to BOLA via a user-controlled key, or, if the endpoint lacked authorization entirely, to missing authorization.

On January 3, 2023 Sam Curry and a team of researchers published Web Hackers vs. The Auto Industry, documenting critical API authorization flaws across about 16 automakers including Kia, Hyundai, Honda, Nissan, Acura, Infiniti, BMW, Ferrari, Porsche, Rolls Royce and Mercedes-Benz, plus telematics providers such as SiriusXM Connected Vehicle Services and Spireon. The connected-car APIs treated the VIN, which is visible through the windshield and effectively public, as an object identifier without verifying the caller actually owned the vehicle, a Broken Object Level Authorization flaw. Using only a target VIN, researchers could enroll a vehicle to an attacker account or bypass ownership checks and then remotely unlock, start, locate, honk, and track vehicles, achieving full account takeover. Several manufacturers also had Broken Function Level Authorization and misconfigured SSO/OTP endpoints exposing internal dealer portals. The work maps to OWASP API1:2023 (BOLA) and API5:2023 (BFLA).

On September 22, 2022 Australian telco Optus disclosed a breach exposing the personal data of around 9.8 million current and former customers (the figure regulators later litigated as approximately 9.5 million), including names, dates of birth, addresses, phone numbers, email addresses, and passport, driver licence and Medicare numbers. The data was served by an internet-facing API endpoint (api.www.optus.com.au) that required no authentication, and customer records were keyed by a sequential, enumerable contactid. An attacker could iterate the identifier (contactId + 1) with a simple script and pull every customer record, combining broken/missing authentication with Broken Object Level Authorization via a user-controlled key. The ACMA alleged an access-control coding error introduced around 2018 weakened the API; Optus fixed the same flaw on its main domain in August 2021 but never on the exposed sub-domain. Regulators characterised the attack as not highly sophisticated.

On 28 April 2021 KrebsOnSecurity reported that researcher Bill Demirkapi had found an unnamed student-loan lender's website performing credit checks via the Experian Connect API in a way that exposed the credit scores of tens of millions of Americans. The lender's loan-eligibility form took only a consumer's first name, last name, mailing address, and date of birth and used them to query Experian's API for an automated FICO lookup. The API enforced no meaningful authentication, and entering all zeros in the date-of-birth field still returned a result, so in practice only a name and address were required. For each consumer the API returned the credit score plus up to four 'risk factors' explaining why the score was not higher, which Demirkapi automated into bulk lookups. This maps to OWASP API2 Broken Authentication (no real auth on the endpoint, defeated by the date-of-birth bypass) combined with Excessive Data Exposure. Contrary to some accounts, no client-side API key was leaked; the flaw was missing authentication, not a leaked credential. Experian fixed the specific endpoint, while Demirkapi warned other lender integrations remained unsecured.

On 24 May 2019 KrebsOnSecurity disclosed that First American Financial Corp. had exposed roughly 885 million mortgage and title records dating back to 2003, including Social Security numbers, bank account numbers and statements, wire transaction receipts, mortgage and tax records, and driver's license images. The records were served by First American's EaglePro document system at sequential URLs containing a nine-digit document reference number. No authentication of any kind was required, so anyone holding a single valid link could simply increment or decrement the document number in the URL to retrieve any other customer's document. This is a textbook Broken Object Level Authorization / IDOR flaw (OWASP API1) compounded by complete Broken Authentication (OWASP API2), with a user-controlled object identifier and no authorization or login check. The defect was introduced in a May 2014 software update and was flagged by First American's own penetration test in January 2019 but left unremediated; researcher Ben Shoval reported it after the company failed to respond. New York DFS later brought a cybersecurity enforcement action (settled for $1 million) and the SEC settled disclosure-controls charges for $487,616.