API4:2023 — Unrestricted Resource Consumption

Slide 26 · The Matrix

Which mitigations stop which attacks?

Real incidents and scenarios mapped to the defenses that would have stopped them.

BREACH — Venmo (2019) · 207M records · Bulk Scraping

Public transaction endpoint, no rate limit, scraped in 30 days

A public API endpoint returned transaction data with no rate limit and no authentication requirement. One researcher's script ran for a month and downloaded 207 million records.

Stopped by: MIT 01 (rate limit: a low req/min cap on the public feed would have made 207M records take years instead of months) + MIT 07 (anomaly: one IP/session consuming millions of records is detectable)

BREACH — Twitter (2022) · 5.4M accounts · Enumeration

Phone-to-account lookup, no rate limit, iterated through phone number ranges

A lookup API accepted phone numbers and returned Twitter accounts. With no rate limit, any authenticated user could map millions of phone numbers to accounts by iterating through number ranges.

Stopped by: MIT 01 (rate limit per user: 10 lookups/min makes mass enumeration infeasible) + MIT 07 (anomaly: user performing millions of lookups is detectable)

OWASP — count=99999999 · DoS · Unbounded pagination

One request with a giant page size saturated the database and crashed the server

A paginated list endpoint accepted client-controlled page sizes. One request with count=99999999 triggered a full table scan and OOM-killed the server process.

Stopped by: MIT 02 (max page size: server enforces max=100 regardless of what client requests) + MIT 04 (execution timeout: kill the query after 10s before it OOM-kills the process)

OWASP — AI inference abuse · Financial · Cost amplification

Unlimited AI generation calls ran up thousands of dollars in third-party costs

No per-user limit on AI inference calls. Attacker scripted 100,000 generation requests. Third-party bill: $2,000 overnight.

Stopped by: MIT 06 (cost quota: 100 generations/day per free user) + MIT 01 (rate limit: max 10 requests/min prevents burst attacks even within the daily quota) + MIT 07 (alert: user crossing 50% of quota triggers review)

← Back Ready to test yourself? →