Posts Tagged

Research

Traveling with OAuth - Account Takeover on Booking.com

Given the widespread usage of OAuth, any vulnerabilities found in its components or their implementations may lead to considerable security impact in the applications and services using them.

Aviad Carmel

March 2, 2023

Salt Customer Attack Case Study: Blocking a Low-rate-per-bot HTTP DDoS Attack

Relying on WAFs alone for API protection is insufficient and leaves companies vulnerable.

Eran Atias

January 12, 2023

Missing Bricks: Finding Security Holes in LEGO APIs

We chose to investigate the services provided by LEGO, perhaps the most famous toy manufacturer in the world – because we contend this example sheds light on the reality of quick adoption of APIs and the risks that can come with that fast pace.

Shiran Yodev

December 15, 2022

How to Protect APIs

As attackers have jumped on the API bandwagon, API threats have also changed, contributing further to the risks and demanding a new approach to protect APIs.

Nick Rago

August 25, 2022

API Security Incidents Nearly Universal Finds Latest “State of API Security” Report

State of API Security Report data highlights a daunting scenario: exploding attack activity, insufficient existing practices, and teams ill-prepared to address API security.

Salt Labs

August 3, 2022

API Threat Research: Server-side Request Forgery on FinTech Platform Enabled Administrative Account Takeover

The Salt Labs team helps customers and prospects discover vulnerabilities in their APIs. In this case, we investigated the platforms of a large US-based FinTech company.

Salt Labs

April 7, 2022

Companies are Struggling Against a 681% Increase in API Attacks, the Latest “State of API Security” Report Shows

Salt Security releases the latest findings of its bi-annual report on API security trends

Salt Labs

March 2, 2022

The Log4Shell CVE-2021-44228 Vulnerability: What it is, how it works, and how to protect yourself

News of the recently discovered vulnerability called “Log4Shell,” “LogJam,” or its formal designation “CVE-2021-44228” has deservedly earned widespread attention. Learn what it is, how it works, and how to protect yourself.

Salt Labs

December 11, 2021

API Threat Research: GraphQL Authorization Flaws in Financial Technology Platform

Salt Labs researchers investigated a large B2B FinTech platform that offers financial services in the form of API-based mobile apps and SaaS to SMB and commercial brands.

Salt Labs

December 8, 2021

API Threat Research: Elastic Stack Misconfiguration Allows Data Extraction

Salt Labs researchers investigated a large business-to-consumer (B2C) online platform that provides API-based mobile applications and software as a service to millions of users globally.

Salt Labs

September 29, 2021

API Attacks up 348% in Six Months, per Latest “State of API Security” Report

The data makes it clear: more companies are suffering more API attacks than ever, and companies remain as ill-prepared as ever.

Salt Labs

July 28, 2021

Formalizing our API Security Research with the Launch of Salt Labs

With the formal launch of Salt Labs, we will now take the time to document our findings publicly, after we follow responsible disclosure processes, so the broader industry can learn from our discoveries.

Roey Eliyahu

July 14, 2021

API Threat Research: Detailed Financial Records Exposed on Financial Services Platform

Threat research report shares information to improve awareness around API security by detailing relevant attack patterns, technical details, and mitigation techniques for each vulnerability.

Salt Labs

July 14, 2021

Subscribe to the Salt blog

Get the latest Gartner® insights on API Protection

Research

Traveling with OAuth - Account Takeover on Booking.com

Salt Customer Attack Case Study: Blocking a Low-rate-per-bot HTTP DDoS Attack

Missing Bricks: Finding Security Holes in LEGO APIs

How to Protect APIs

API Security Incidents Nearly Universal Finds Latest “State of API Security” Report

API Threat Research: Server-side Request Forgery on FinTech Platform Enabled Administrative Account Takeover

Companies are Struggling Against a 681% Increase in API Attacks, the Latest “State of API Security” Report Shows

The Log4Shell CVE-2021-44228 Vulnerability: What it is, how it works, and how to protect yourself

API Threat Research: GraphQL Authorization Flaws in Financial Technology Platform

API Threat Research: Elastic Stack Misconfiguration Allows Data Extraction

API Attacks up 348% in Six Months, per Latest “State of API Security” Report

Formalizing our API Security Research with the Launch of Salt Labs

API Threat Research: Detailed Financial Records Exposed on Financial Services Platform

Tags

Posts by