How to Prevent Mobile App API Abuse: Attacks and Counter-Measures - Seguridad Mania.com - España y América Latina

Think a good user authentication solution is enough protection? Think again. Follow the ShipFast courier service’s evolving mobile app and API security defenses as it beats back malicious ShipRaider. As ShipFast launches its mobile app with hidden API keys and OAuth2 user authorization, we'll start discussing the existing security threats and how to counter them. Along the way, TLS, certificate pinning, HMAC call signing, app hardening, app attestation and more will strengthen ShipFast's security posture, but ShipRaider will be working hard trying man in the middle attacks, app decompilation and debugging, exploit frameworks, and other reverse engineering techniques to keep exploiting ShipFast's API. This fast-paced overview of mobile attacks and counter-measures demonstrates the defense in-depth techniques required to protect both your mobile apps and your API backends.