When the attackers lose, case studies in API security strategies

The talk is a collection of real API abuse cases in which attackers were thwarted, continuing an earlier discussion about counting events in login and API traffic. One retailer's inventory endpoint was queried repeatedly to track a scarce item, and a deceptive reply claiming stock was available led to an arrest. Other cases include a public airline Wi-Fi purchase endpoint used to test stolen debit cards, and a gift card balance lookup that let a bot walk through card numbers at scale.

Further examples cover account aggregators, where one compromised credential exposes many linked bank accounts, and a funds-transfer API that granted ordinary users administrative rights, letting attackers siphon small amounts for a long time. Bots that resell shoes and repeatedly poll shipment tracking endpoints, along with fake free-trial server signups used to validate cards, round out the cases. Common signals include traffic from cloud or hosting address ranges, stale user agents, unusual per-account volume and odd sequences of calls, which analysis can surface by pivoting on fields such as IP address and phone number.

The practical takeaways are to expire long-lived keys, require step-up authentication for money movement, tie tokens to user accounts, verify new email addresses, and rely on IP reputation and behavior analysis, since CAPTCHA often cannot sit in front of an API. The talk also argues that the industry needs a standard API signal that tells other institutions when an account has been compromised.