Hack your APIs: interview with Corey Ball - API security expert
Summary: Corey Ball, a cybersecurity consulting manager and author of the forthcoming book Hacking APIs, described in a November 2020 PortSwigger interview how microservices complexity and long-standing flaws like broken object level authorization, directory traversal, SQL injection and stolen credentials have produced a wide range of API vulnerabilities. The article cites a 2020 Starbucks bug bounty for an API flaw that potentially exposed records of up to 100 million customers, a 2018 USPS issue that let any account holder view and sometimes modify details for around 60 million users, and Gartner's prediction that by 2022 API abuses will be the most frequent attack vector causing data breaches in enterprise applications.
What's compelling: The USPS breach happened despite a vulnerability assessment run a month earlier that missed the flaw, and Ball's point is that scanners routinely return false negatives on APIs - so a clean scan is not evidence your API attack surface is covered.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026