API1:2023 — Broken Object Level Authorization

Slide 26 · The Matrix

Which mitigations stop which attacks?

Real breaches mapped to the defenses that would have stopped them.

BREACH — Peloton (2021) · 4M users · No auth required

Unauthenticated access to any user's private fitness data

The endpoint had no authentication at all — any HTTP request returned data. Beyond BOLA, this was a complete auth failure.

Stopped by: MIT 01 (ownership check) + MIT 03 (derive identity from token, don't trust client) + MIT 04 (cross-user testing would have caught this immediately)

BREACH — T-Mobile (2023) · 37M customers · 6 weeks undetected

Mass enumeration of customer records via API

Authorization check existed but failed in practice. Attacker ran millions of queries over weeks — no alert triggered.

Stopped by: MIT 01 (working auth check) + MIT 07 (monitoring — 37M queries should have fired an alert on day one) + MIT 06 (centralized enforcement would have closed the policy gap)

BREACH — Bumble (2020) · Any user's location · Blocked users bypassed

Precise GPS coordinates exposed via profile API — blocking ignored

The API returned location data regardless of block status. The authorization check didn't account for the social relationship between users.

Stopped by: MIT 01 (ownership check — also verify block status) + MIT 03 (server derives requesting identity, checks relationship) + MIT 05 (query filters that include block relationships)

BREACH — USPS (2018) · 60M accounts · Sequential user IDs

Any authenticated user could read any other user's account details

Sequential integer user IDs + no object-level check = trivial enumeration of 60 million accounts.

Stopped by: MIT 01 (ownership check) + MIT 02 (UUIDs would make enumeration impossible) + MIT 07 (sequential ID pattern is obvious in logs)

← Back Ready to test yourself? →