Pierluigi Paganini
November 22, 2022
It’s no secret that cyber security has become a leading priority for most organizations — especially those in industries that handle sensitive customer information. And as these businesses work towards building robust security strategies, it’s vital that they account for various threat vectors and vulnerabilities.
One area that requires significant scrutiny is API security. APIs, short for application programming interfaces, have become a common building block for digitally enabled organizations. They facilitate communication as well as critical business operations, and they also support important digital transformations. It’s no surprise then that the average number of APIs per company increased 221% in the last year.
Crafting an API security strategy is a complex task. APIs have unique threat implications that aren’t fully solved by web application firewalls or identity and access management solutions. The first step to getting it right is to understand what the common vulnerabilities are.
In its API Security Top 10, the Open Web Application Security Project (OWASP) identifies the top ten threats to APIs. Below, we take a closer look at some of the most common.
APIs with broken object level authentication allow attackers to easily exploit API endpoints by manipulating the ID of an object sent within an API request. The result? BOLA authorization flaws can lead to unauthorized viewing, modification or destruction of data, or even a full account takeover.
Today, BOLA accounts for 40% of all API attacks. One of the primary reasons they’re so prevalent is that traditional security controls like WAFs or API gateways can’t identify them as anomalous to the baseline API behavior. Instead, businesses need an API solution that can spot whenan authenticated user is trying to gain unauthorized access to another user’s data.
There are a number of factors that can lead to broken user authentication in an API. This includes weak password complexity or poor password hygiene, missing account lockout thresholds, long durations for password or certificate rotations, or relying on API keys alone for authentication.
When an API experiences broken user authentication, cyber criminals can use authentication-related attacks like credential stuffing and brute-force attacks to gain access to applications. Once they’re in, the attackers can then take over user accounts, manipulate data, or make unauthorized transactions.
When it comes to traditional security methods, they often lack the ability to track traffic over time, meaning they can’t easily identify high-volume attacks like credential stuffing. As such, an API security solution should be able to identify abnormal behavior against a typical authentication sequence.
A common issue with most APIs is that, for the sake of efficiency, they’re often set up to share more information than is needed in an API response. They then leave it to the client application to filter the information and render it for the user. This is problematic because attackers can use the redundant data to extract sensitive information from the API.
While some traditional security solutions can identify this type of vulnerability, they can’t always differentiate between legitimate data returned by the API and sensitive data that shouldn’t be returned. This means an API security solution should be able to spot when a user is consuming too much sensitive data.
APIs don’t always have restrictions for the number of resources that can be requested by the client or a user. This leaves them open to server disruptions that cause denial of service, as well as brute-force and enumeration attacks against APIs responsible for authentication and data fetching. Plus, attackers can set up automated attacks against APIs that don’t have limits, including credential cracking and token cracking.
Traditional solutions will have some basic rate limiting functionality, but it’s not always easy to deploy at scale. As such, these security tools often lack the context required to flag an attack when it’s happening. A modern API security solution should be able to identify any activity that falls outside of normal usage values.
There are a number of security misconfigurations that can accidentally introduce vulnerabilities into APIs. These include incomplete configurations, misconfigured HTTP headers, verbose error messages, open cloud storage, and more. Attackers can leverage these to learn more about the API components, and then exploit the misconfigurations as part of their attack.
Comprehensive API solutions can identify these misconfigurations and provide remediation suggestions.
Attackers are always evolving their strategies for compromising APIs, looking for new threat vectors and leveraging new vulnerabilities. What’s common in most successful attacks is that they target gaps in business logic. This means that to establish a proactive API security strategy, organizations must account for these gaps at every step.
About the Author: Ali Cameron is a content marketer that specializes in the cybersecurity and B2B SaaS space. Besides writing for Tripwire’s State of Security blog, she’s also written for brands including Okta, Salesforce, and Microsoft. Taking an unusual route into the world of content, Ali started her career as a management consultant at PwC where she sparked her interest in making complex concepts easy to understand. She blends this interest with a passion for storytelling, a combination that’s well suited for writing in the cybersecurity space. She is also a regular writer for Bora.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, API Vulnerabilities)
[adrotate banner=”5″]
[adrotate banner=”13″]
