MOVEit Transfer Exploitation (my API presentation recording)
Source: YouTube · John Hammond · published Jun 30, 2023 · 21:13
The presentation analyzes the MoveIt transfer exploitation attack chain (CVE-2023-34362) with focus on how attackers leveraged the application's API after an initial authentication bypass 1:14.
Key Takeaways:
• The MoveIt vulnerability was exploited by the Clop ransomware gang, affecting numerous organizations including British Airways, BBC, and New York City Department of Education 2:35
• Attackers began with SQL injection to bypass authentication without needing credentials 5:55
• The critical API component was an undocumented feature allowing attackers to use their current session as authentication rather than requiring API tokens 13:02
• With session-based API access, attackers manipulated files, uploaded malicious content, and executed remote code to exfiltrate data 15:25
• The proof-of-concept demonstration showed how attackers could leak API tokens and eventually compromise the entire server 17:02
Understanding attack chains, including API components, is essential for building effective security defenses against advanced persistent threats 20:24.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
I was invited to speak at the API days interface online virtual conference and I thought hey I'll give a short 25 minute or so presentation on kind of the API component of the move it transfer exploitation attack chain we don't dive into the SQL injection of the remote code execution we focus on a little bit of the API but hopefully it's still a little bit of fun this video is just a simple recording of that presentation hope you enjoy our next guest probably doesn't need much introduction for any of you who follow security or API security specifically um John Hammond is joining us and he is going to talk with us about apis and apts and manipulating access in current events John welcome to the show thank you so much thank you thank you hey it's great to be here this is gonna be a ton of fu…