Threat video1:00
Wiz Red Agent Airline GraphQL BOLA: Detection & IOCs
Wiz's AI red-team agent read airline passenger data in 15 minutes via sequential booking IDs. 9 detection rules, 20 IOCs and a free Splunk SPL rule.
Read the full threat intel for Wiz Red Agent Airline GraphQL BOLA: Detection & IOCs →
Chapters
- 0:00The hookAPI breached in fifteen minutes: zero credentials.
- 0:04The storyObtained anonymous token via endpoints.
- 0:12Attack pathReplayed endpoints, minted anonymous token.
- 0:27AttributionNo threat actor is attributed.
- 0:31Indicators of compromiseNo malicious indicators were published.
- 0:37MITRE ATT&CK techniques19 ATT&CK techniques, from reconnaissance to impact.
- 0:42Remediation5 steps now: Add object-level authorization checks to every GraphQL resolver that accepts.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00API breached in fifteen minutes: zero credentials.
0:05Obtained anonymous token via endpoints.
0:07Sequential IDs leaked all customer records.
0:12Replayed endpoints, minted anonymous token.
0:15Confirmed BOLA via sequential booking IDs.
0:18Exposed two years of passenger data.
0:21Write access enabled hijacking, cancellations, refunds.
0:27No threat actor is attributed. Confidence: low.
0:32No malicious indicators were published.
0:3719 ATT&CK techniques, from reconnaissance to impact.
0:425 steps now: Add object-level authorization checks to every GraphQL resolver that accepts.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.