Perfectly Coded APIs Can Be Susceptible To Attack

An Application Programming Interface (API) is a way for two or more computer programmes to communicate with each other - a type of software that offers a service to other pieces of software. API development has seen an over emphasis on ‘shift left’, whereby security testing, quality and performance are carried out solely in the development process rather than throughout the entire release cycle.  

While this has allowed departments to develop and roll out their own “secure” APIs, it assumes that the developer is happy to ‘mark their own homework’ and fix the code when many hate this aspect of the job. 

But there’s another more serious danger in that it creates a false sense of security. The assumption is that APIs that go live are then bullet proof.

In reality, while shift left efforts are beneficial, no measures will stop a persistent automated attack. If the assets being protected by that API are attractive enough, attackers will persist and will compromise it usually by using its own functionality against it in an attack known as business logic abuse.

Even if the API is coded perfectly correctly, adheres to the API specification it is designed against, and is properly inventoried and has been tested to ensure it is not susceptible to any of the OWASP (Open Web Application Security Project) Top Ten API Threats, it can still be probed and compromised. 

Research conducted during the first half of 2022 reveals that APIs were subjected to automated business logic abuse in numerous ways. Over three billion shopping bots were used to target well-formed APIs with a dense network of highly volumetric and geographically distributed fuzzing payloads. Over 290 million malicious gift card requests used enumeration based on fuzzing the numeric patterns on APIs that support payment and checkout microservices. And there were over 37 million comment spam requests detected against customer relationship management workflows.

Combined Assaults

Perfectly coded and inventoried APIs take more effort to compromise and so attacks will typically use multiple methods from the OWASP Top Ten. For instance, we’ve seen something we call the attack trifecta where attackers used API2 (Broken User Authentication), API3 (Excessive Data Exposure) and API9 (Improper Assets management), to perform detailed reconnaissance and analysis of how each API works, how they interact with each other, and the expected outcome. That information was then used for malicious purposes. 

Another real-world example is the Ulta Beauty case study where a large scale enumeration attack was executed against a third party inventory API. The inventory search API supplier notified the company security team of a traffic surge, requesting help to stop the attack. The investigation mapped the attack to OWASP API4 (Lack of Resources and Rate Limiting) and API5 (Broken Function Level Authorisation). 

Initially, the attackers targeted the web API before moving to the mobile API which provides similar information. The attack targeted the inventory API directly, without hitting any other app or web function (in contrast, normal behaviour would show the user traversing multiple APIs, generating upwards of 40-50 cookies as they browsed the inventory, whereas the attack generated just one). 

Originating from residential proxy IP addresses, the attack rotated through 153,000 unique product and SKU combinations while scraping 61,000 ZIP codes and 33,000 products but Web Application Firewall (WAF) and Content Delivery Network (CDN) mitigation efforts were ineffective. It was only stopped by policies that effectively blocked 85.9 million requests.

The Difficulty Of Detection 

In this particular case the company was alerted by its provider but how can businesses spot attacks against what they consider to be secure APIs? Web Application Firewalls (WAFs) or bot prevention tools are ineffective at preventing an API specific attack for several reasons. 

WAFs use signatures to detect known vulnerabilities as described in the OWASP Web Application Top 10 Threats list so will struggle to find and block attacks that appear legitimate, and they are unable to address the entire API protection lifecycle. Bot tools rely on JavaScript instrumentation to collect the telemetry required to understand and block the attack. As an API is clientless, it cannot be instrumented in this manner. Consequently, those that believe their APIs are secure and rely on traditional web security tools are lulled into a false sense of security.

The first step in any API protection initiative should always be a runtime inventory. This automatically logs all known and unknown endpoints, helping to discover and prioritise APIs by assessing the risk they represent, and applying sensitive data exposure protection and business logic abuse protection. The next step is to protect the APIs from attacks  using Machine Learning to determine the intent of transactions (whether performed by bots or individuals) and then quickly block them or send them down another path. 

With runtime security covered, development teams should look at more API specific testing solutions to complement and strengthen existing shift left efforts. Dynamic Application Security Testing (DAST) solutions that use specifications and documentation to understand how an API works, then looks for vulnerabilities should also be considered. Traditional web-focused testing tools lack the ability to derive the API context needed to test and find gaps and this is where DAST can really add value.  

There also needs to be acceptance that, while shift left is helping organisations deliver more secure APIs, even a perfectly coded API can be attacked. The OWASP Top Ten lists are useful, but should be viewed as a starting point.

Until we face up to the fact that all APIs will fall to a determined attacker, we can’t begin to adequately protect them.   

Andy Mills is VP for EMEA at Cequence Security

You Might Also Read: 

Types Of Security Testing Explained With Examples:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Europol Arrest Crypto Currency Fraud Gang
Sexual Abuse & Harassment Of Women »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

ON-DEMAND WEBINAR: Learn how SOAR helps you streamline security

ON-DEMAND WEBINAR: Learn how SOAR helps you streamline security

Watch this webinar to explore the Security orchestration, automation, and response (SOAR) paradigm, its relationship with organization IT practices, and its role in your security strategy.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Eversheds Sutherland

Eversheds Sutherland

Eversheds Sutherland is a global multinational law practice offering a full range of commercial and IT law services including Privacy, Data Protection and Cyersecurity.

Cyberlytic

Cyberlytic

Cyberlytic applies artificial intelligence to combat the most sophisticated of web application threats, addressing the growing problem of high volumes of threat data.

Cimcor

Cimcor

Cimcor’s flagship software product, CimTrak, helps organizations to monitor and protect a wide range of physical, network and virtual IT assets in real-time.

BrainChip

BrainChip

BrainChip is the leading provider of neuromorphic computing solutions, a type of artificial intelligence that is inspired by the biology of the human neuron - spiking neural networks.

IberLayer

IberLayer

IberLayer is the company behind the Email Guardian service, a cloud based Email Total Protection system that filters and blocks email threats.

ioXt Alliance

ioXt Alliance

The ioXt Alliance is a group of manufacturers, industry alliances and government organizations dedicated to harmonizing best security practices in a highly connected world.

CyberSecurityMastersDegree.org

CyberSecurityMastersDegree.org

Our mission at CyberSecurityMastersDegree.org is to serve as a comprehensive and completely unbiased resource for anyone interested in earning a master’s degree in cybersecurity.

Q6 Cyber

Q6 Cyber

Q6 Cyber is an innovative threat intelligence company collecting targeted and actionable threat intelligence related to cyber attacks, fraud activity, and existing data breaches.

Tetrad Digital Integrity (TDI)

Tetrad Digital Integrity (TDI)

TDI is a world-class consulting firm offering cybersecurity services to government agencies and commercial clients around the world.

Cyphere

Cyphere

Cyphere is a cyber security company that helps to secure most prized assets of a business. We provide technical risk assessment (pen testing/ethical hacking) and managed security services.

Xopero Software

Xopero Software

Xopero Software develops a comprehensive range of professional tools for protecting and restoring critical business data.

xorlab

xorlab

xorlab is a Swiss cybersecurity company providing specialized, machine-intelligent defense against highly engineered, sophisticated and targeted email attacks.

BDO Global

BDO Global

BDO is an international network of public accounting, tax and advisory firms which perform professional services under the name of BDO.

Secure Cyber Defense

Secure Cyber Defense

Secure Cyber Defense provides expert cybersecurity consulting and managed detection and response services to companies, local government, schools and universities.

Coviant Software

Coviant Software

Coviant Software delivers secure managed file transfer (MFT) software that integrates smoothly and easily with business processes.

Halogen Group

Halogen Group

Halogen Group is the leading Security Solutions Provider in West Africa. Services encompass Physical Security, Electronic Security, Virtual & Cyber Security, Risk Assessments and Training.