Gregory Pickett - Breaking the Back End: Sometimes it's Just Bad Design

Backend API Design Flaws

Gregory Pickett, founder of Hellfire Security, presents a series of real-world backend vulnerabilities stemming from architectural design failures rather than implementation bugs — flaws that persist even after individual CVEs are patched.

Insecure Direct Object References at Scale

Examples include healthcare and financial APIs that expose sequential integer identifiers for patient records and account numbers, enabling mass enumeration without authentication.

Broken Access Control Architectures

Pickett presents systems where authorization decisions are made client-side, with the backend trusting an unverifiable user role embedded in the JWT payload, enabling privilege escalation by token manipulation.

Business Logic Vulnerabilities

Beyond technical bugs, the talk covers business logic flaws — APIs that allow negative quantities in shopping carts, loyalty point transfers exceeding account balances, and time-of-check/time-of-use race conditions in financial transactions.