In an era where mobile applications are a crucial part of our daily lives, the security of these applications, especially Android apps, has become paramount. As per a report by Statista, in 2022, there were 1802 data breaches in the United States, with over 422.14 million individuals affected.
Welcome to the 6th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API5:2023 Broken Function Level Authorization. In this series we are taking an in-depth look at each category – the details, the impact and what you can do about it.
In over 600 data breaches, 40 million individuals were affected across the globe due to the MOVEit Transfer vulnerability. Between June 2023 and the present day, healthcare information, educational records, financial records, personal information, Social Security numbers, and insurance details have been either stolen or wiped out by threat actors who abused the MOVEit Transfer vulnerability.
Five worthy reads is a regular column on five noteworthy items we’ve discovered while researching trending and timeless topics. This week we explore website cookies, their role in managing user identity and behavior, and the key ingredients to a safe cookie policy. There’s no worse way to enter a website than to be met with a cookie consent encounter. But how many of us click “Accept All” without much thought, just to rid ourselves of the interruption?
Cross-Site Scripting (XSS) is a web security vulnerability that happens when cybercriminals inject client-side scripts into web pages accessible by other users. These scripts compromise the web page and allow cybercriminals to inject malicious scripts into a user’s browser, leading to the exposure of data, session hijacking or manipulation of the web page’s content and functionality.
It’s been reported that 2.6 million user records sourced from the Duolingo app are for sale. The attacker apparently obtained them from an open API provided by the company. There’s a more technical explanation available here. While we talk a lot about the vulnerabilities in the OWASP API Top-10 and the exploits associated with those vulnerabilities, this incident provides a good reminder that not all vulnerabilities are flaws in code. In fact, this API was working as designed.
