Trust but verify.

This was the key takeaway that security penetration tester and “reformed hacker” Alissa Knight offered during a session on hacking banks through their APIs at the Money 20/20 conference in Las Vegas on Wednesday.

The virtual chief information security officer for the $1.3 billion digital Quontic Bank, Knight is also a former analyst with the Aite Group, a writer, a serial entrepreneur and owner of an entertainment company.

Knight debuted at Money 20/20 in 2019, after hacking 30 mobile apps. This year, she returned to the event to say the security situation hasn’t improved; in fact, she had leveraged the vulnerabilities of APIs to hack an astonishing 300 bank APIs.

“I was able to use the APIs to change the PIN code of any big customer and transfer money in our accounts using the APIs,” Knight said. “It is a back door into the network.”

What made it so easy to hack 300 bank APIs?

It turns out, all 300 were derived from the same set of code that had been developed for one bank by an outsourcer, then rebranded across 300 financial institutions. Once Knight discovered which vulnerabilities she could exploit, it was just a matter of finding out which banks had deployed the same solution.

This is what can happens code development is outsourced and “pen,” or penetration testing, is not required, Knight said. “That same vulnerable code was rinsed and reused in 300 other banks.

“Trust, but verify,” she added.

Two types of vulnerabilities were leveraged for the hacks: A broken object level authorization (BOLA) and a broken authentication. Knight compared a BOLA to a coat check scam; after seeing someone check in a nice coat, the scammer checks in their own coat, then alters the ticket number to retrieve the better coat.

“I’m authenticated, I’m allowed to be there, I have a ticket, I have my account. And I’m giving a ticket — but it’s not my coat,” Knight said. “I’m requesting data that doesn’t belong to me.”

APIs can work the same way; the hacker can use an access code, then manipulate the numbers in the code to access other accounts or records. It’s a simple but common vulnerability.

Broken authentication vulnerabilities are even more numerous than BOLAs, according to API security firm Salt Security.  In this case, Knight was able to use what she called a “woman in the middle” attack, in which a hacker interjects into the middle of a communication between the app and the backend API, allowing the hacker to break the encryption by presenting a legitimate certificate to the API.

“It’s interjecting myself in the middle of the communication between the mobile app or the web app, and the backend API,” Knight explained. “Now somebody’s like, ‘Listen, that’s encrypted. You can’t do that.’ Oh contraire, mon frere. …You’re presenting a certificate to both ends of the communication.”

What’s more, once Knight turned off cookies she found there was no authentication requirement on the APIs. Using these vulnerabilities, she was able to change debit card pins and conduct illicit money transfers.

And it wasn’t just small banks that were vulnerable; the banks Knight hacked ranged from 10 to 200,000 employees across a range of types, including neobanks, cryptocurrency exchanges and mainstream brick-and-mortars, she said.

“There’s so much outsourcing that happens in banking, I’m really shocked. … Please, if you’re going outsource, it doesn’t mean that you’re just going to trust everything that they give you,” Knight said. “You need to pen test it. Hack your own stuff before the bad girls do.”