Securing Spend To Address API Attacks

Uploaded on 2025-06-09 in TECHNOLOGY--Resilience, FREE TO VIEW, BUSINESS-Services-IT & Telecoms

Awareness is growing around the threats posed to Application Programming Interfaces (APIs) which now constitute over 70% of the traffic on the internet and are fundamental to the real-time provision of digital services.

Everything from open banking to ride sharing apps to ecommerce now uses APIs to connect the end user to back office data to complete a request or transaction but as gatekeepers to that information they’re also a key target for attackers.

Consequently, analyst house Forrester has identified APIs as one of the top three areas for investment in 2025. So how can CISOs go about securing budget to dedicate to their protection?

Last year proved to a painful one for the CISO when it came to API attacks. In May, Dell saw a partner portal API abused, for example, with the attacker able to gain access within two days simply by logging multiple fake company names and registering his interest to become a partner. He was then approved enabling him to obtain personally identifiable information (PII) on 49 million customers across of range of Dell products from monitors to notebooks, desktops and laptops.

Infamous API Incidents

Trello, a project management solution, too saw 15 million user emails compromised via an unsecured API and put up for sale. According to reports, the attacker fed 500 million email addresses to the API and those that matched with a Trello account then returned valid account information including the user’s full name, equipping them with enough information to create profiles that could then be used for identity fraud.

Another instance of an API enabling fraud on a massive scale can be seen in the breach of DocuSign’s Envelopes API. The API is usually used by developers to create, sign and manage document containers and hacking it allowed the attackers to create and issue fake invoices to unsuspecting victims who believed they came from bona fide companies such as Norton and Paypal. The invoices were all the more convincing because they appeared to come from a Docusign domain address.

This year we’ve also seen a number of API abuses. Google quickly remedied an issue that saw two APIs – YouTube and Pixel Recorder – combined to reveal email accounts associated with YouTube accounts while a sophisticated skimming campaign carried out against Legacy Stripe used a deprecated API to validate stolen payment cards, thereby making it a much quicker and easier process to determine which would work and could be used or sold on.

These are all attacks where it’s been disclosed that APIs were involved but the uniquity of APIs and their role in service provision means they are often associated with a plethora of attack types such as credential stuffing, account takeovers and fraud. They may not be mentioned, but they play a factor. As a result, it’s fair to assume the APIs mentioned above are just the tip of the iceberg.

Underinvestment In API Security

Yet convincing the board that APIs require dedicated investment can be an uphill struggle, particularly if they labouring under the misapprehension that they’ve already got it covered.

In many organisations, API rollouts have been protected using solutions that were not designed for the job such as Web Application Firewalls (WAFs). These are IP-based and use signature detection which means they struggle to detect attacks such as business logic abuse whereby the functionality of the API is used against it. Business logic abuse happens when the attacker is able to study and test out requests to the API until they find a way for it to process the request in a way that returns valuable information and, as it apes legitimate use, is extremely difficult to detect.

API Gateways are able to provide some rudimentary security but are predominantly designed to centralise and manage APIs. They might work in tandem with the API when it comes to features such as rate limiting on the API which restrict the number of requests, for instance.

But attackers can easily overcome such measures by using proxies to mask IP addresses, distributing attacks across multiple sources, or using botnets to overwhelm the API.

Trying to use these solutions to secure APIs will therefore only ever provide scant protection because of the ways in which APIs succumb to attack. They are built to serve so will tend to betray information and this means the best way to protect them is to observe those requests and determine if they are malicious in nature.

Consequently, behaviour based analysis is key to monitor and determine intent. If an attack is suspected, this can then be tracked using machine learning to analyse the API header and payload, creating a unique fingerprint of the attack. Should the attacker then pivot and change tactic, it remains possible to continue to monitor their activity regardless of how many IP addresses they cycle through. And defenders can take mitigating action such as by blocking or throttling traffic or by using deception to exhaust the attacker’s resources.

An Unsustainable Approach

Being able to track and counter attacks in this way not only prevents the attacker from running circles around the API but also avoids the danger of frustrating legitimate users and damaging the user experience. That’s a crucial consideration for any business.

But it’s also worth noting that we can expect the sophistication of attacks to increase due to Generative AI (GenAI), further upping the ante in the attacker’s favour. As cyber criminals begin to train datasets and leverage the technology, we will begin to see the number of attacks against these interfaces increase exponentially. This will lead to GenAI being used to carry out API reconnaissance such as by scraping sites and studying APIs before executing attacks in a way that even more closely mirrors legitimate use.

The attacks we’ve seen to date reveal that APIs are still failing to be adequately tested during development, configured correctly, and discovered, managed and deprecated during their lifetime. But there’s also real evidence that attackers are becoming inventive in the ways they utilise APIs, as demonstrated by the DocuSign attack and GenAI will make such attacks more commonplace.

Taking a make do and amend approach to API security is not working, necessitating a dedicated solution. It’s therefore imperative that CISOs point out how attacks are evolving and the shortcomings of existing solutions to secure budget and pursue Forrester’s recommendations.

Mohammad Ismail isVP of EMEA at Cequence Security

Image: Ideogram

You Might Also Read:

Five Reasons Your Organization Needs API Security Testing:

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.