The Economics of API Attacks and How Developers Can Stop Them
Hackers go where the money is, and right now they’re finding a rich source in exploiting APIs to steal profitable private information, said Jonathan Care, a cybersecurity expert.
“Why does API security need to be at the center of your security focus? Because 80% of internet traffic flows through API,” Care, a former Gartner cybersecurity analyst who is now with Lionfish Tech Advisors, during the Feb. 27 webinar, “Peering into the Abyss: Inside the API Data Breach” by API security provider Cequence Security. “And of course, where traffic goes up, then the attackers follow as well. It’s fairly logical why: As Willie Sutton used to say, ‘I attack banks because that’s where the money is.’”
Exploit kits are not expensive, Care said; one can be rented for about $1,400 per month. Blended exploits are a common tactic, he added, where the attacker gets shell access to a sensitive server by stealing data and then uploading ransomware.
“Attackers do make an economic model out of this. This is my cost of attack, this is my expected return, whether it be data theft, fraud, or uploading ransomware,” he said. “And all of these things are possible through API exploits.”
Shifting to an API-Focused Posture
Despite this reality, organizations have focused on securing infrastructure and end-user web application attacks while leaving APIs vulnerable, he said. The defense model has been a castle with a moat, but that metaphor needs an update, he added.
“We’re not defending a castle, here, we’re defending the marketplace, which means that we have to defend multiple points and not just a single point of entry, because of course, people will come in from everywhere, actors will come in from everywhere, and seek to do business in the marketplace with the APIs that we make available,” he said.
The speed of development and the shift to microservices have amplified the need for an API-focused security posture, Care added. He advised organizations to begin an “active, persistent, consistent discovery and inventory process” that maps applications and maintains an updated list of APIs. It’s the unmanaged APIs that pose the greatest risk, he said.
OWASP, the Open Web Application Security Project, also now talks about the importance of OAuth API security and API security in general in its latest evolution, he said.
“We know the pressure that developers are under to deliver and render capability and content rapidly,” he said. “There’s going to be this never-ending battle to discover and gain full visibility of where APIs are located, where the application has APIs, how they’re accessed.”
Although Care stopped short of saying API security is an issue for developers to manage, he did point to developer practices that could put companies at risk. For instance, in the case study of a fitness company, an API had no authentication because the developer put it in place thinking it wouldn’t last and would be refactored in the next development cycle.
“Of course, it didn’t happen, and as a result, you have an API that is exposed with little or no authentication, which allows sensitive data; and in this case, personal information was exposed,” he said.
It’s also important to not consume third-party APIs in an unsafe way, Care said, adding that the concern for APIs should also extend to mobile, Internet of Things (including automotive), and Operational Technology applications.
“There’s a wealth of API data inside your vehicle right now,” he said. “And it’s available to […] application developers, it’s available to service technicians, and also it can be misused by attackers.”
Two Primary Types of API Attacks
Care went through attack timelines for two different incidents, including one that used a shadow API. He described two primary ways of attacking APIs or exploiting shadow APIs:
- Broken object property level authorization or BOPLA attacks, where the API provides more information than was in the scope of the additional request, allowing the attackers to exploit it and pull out more information. This is a new addition to the OWASP list and focuses on the authorization for individual properties within an object. An attacker can exploit this to access or manipulate unauthorized properties, even if they have access to the overall object.
- Broken Object Level Authorization, or BOLA attacks, which is where someone basically changes the identification number by one and is able to access other customers’ data,
“This makes it very easy for a bot for a scripted agent, to just mine through […] in this case, a popular fitness organization’s sensitive data,” he said. “If we had discovery in place, we would have been the ones who found those open endpoints, we would have been the ones who went, ‘Hey, look what you can do. If you manipulate the URLs, you can actually reveal shadow APIs.’”
What Developers Can Do
Care stressed that developers should not use social security IDs, phone numbers, or emails addresses as customers identifiers. The lack of an authentic authorization check can allow an attacker to sweep through the customer information base, he said. In one case he referenced, the broken authentication was made worse because there was no validation of the user input, allowing the attacker to get access to, in this case, credit scores and other sensitive financial information.
“We’re into our old friend BOPLA once again, broken object property level authorization — [where] the API could be polled for the FICO score with very weak authentication,” he said. “So guess what, not only can I start pulling out information on a victim, I can do a bit of identity theft, but I can then check out how good a victim they are, how much credit could I get in their name.”
All of it can be easily fixed once it’s identified; but again, many companies don’t discover API security flaws because they’re not looking.
“Most retailers don’t find out of their own volition that they’ve been breached, [that] their payment systems have been popped by an attacker. They get told by their bank, who’ve usually been told by the big credit card companies,” he said. “And so you can find that your alerts come from outside; and believe you me, that’s not comfortable.”
That’s why it’s important to start by discovering all available APIs and adding them to a registry, then apply enterprise security policies to all of the registered APIs, Care said.
Tools such as API inventory products and API compliance products can help identify and assess APIs within an organization’s footprint while integrating into the CI/CD pipeline, added Muzaffer Pasha, who leads product marketing at Cequence. He also recommended that organizations use an API threat detection response solution that can block API attacks in real time.
