An API attack is abusive or manipulative usage or attempted usage of an API, commonly used to breach data or manipulate a commerce solution.
The growth of API (application programming interface) is more important than ever. It can lead to malicious traffic growth consequently. According to a Gartner By 2022, API abuses will move from an infrequent to the most frequent attack vector, resulting in data breaches for enterprise web applications. It is extremely important to acquire a clear idea of these threats, we will dive into more technical terms in order to have a structured clear idea of the different API attack types.
Click next If you’re looking for a guide about how to secure REST API instead.
Broken Access Control
Access control policy ensures that users can not act outside their intended permissions. Failure leads to information disclosure, modification or destruction of data. When we are looking for this kind of vulnerability, sometimes we can tamper parameters(for example id parameters) and get a successful attack . Depending on the specific vulnerability, the consequences can be devastating. The worst case scenario is when an unauthorized user has access to a privileged function. This can give them the ability to modify or delete contents on the website, or get sensitive data on users.
DDoS attack
A distributed denial of service type of attack can make an Api endpoint unreachable or derail it, online ecommerce systems will be open to IDA (inventory denial attacks).
SQL Injection Attacks
SQL Injection attacks are methods for inserting SQL queries into the input fields through the SQL database underlying the system. These defects can then be misused if forms enable users to query the database using SQL statements directly.
Man in the Middle (MITM)
A Man in the Middle attacks exactly what it means; an attacker discreetly alters, relays, and intercepts messages and requests between two parties to obtain sensitive information. A hacker can act as a man in the middle between a session token issuing API to an HTTP header and a user. If the hacker can intercept that session token, it would grant him access to the user’s account, which can lead to (possibly) a tonne of sensitive and personal information.
Excessive Data Exposure
Web applications frequently process and transfer sensitive data: credit card information, passwords, session tokens, private health information, and more. An information exposure occurs when these data are left exposed on the server for anyone to access
This happens when the api does not filter the response before it reaches the client ( failure of the developer to handle the data correctly).
Improper Assets Management
Improper asset occurs when there are more than one version of an API, and developper forget to delete the first one, or another scenario for example a testing API endpoint is left connected to the production environment. APIs tend to expose more endpoints than traditional web applications, making proper and updated documentation highly important. A good management of the inventory also plays an important role to reduce issues with old or vulnerable API versions.
Unencrypted Communications
Transport Layer Security (TLS) is one of the most elementary API security protection methods. the TLS encrypts the data exchange between client and the server, so you could avoid man in the middle attack. Poodle discovered in 2014 is a famous attack against tls , poodle fallback to ssl 3.0 (downgrade security protocol) to reveal information encrypted from ssl.
Broken User Authentication
API authentication is a critical service that identifies and authorizes clients to access applications. A broken authentication refers to a weakness into two mechanisms : improper session management, and credential management; both of them enable attackers to use stolen authentication tokens, or to brute force or use stolen credentials in order to gain unauthorized access to applications.
Having a good understanding of which type of attack can occur in our business is the first step for a robust API; the second step will be how to secure RestAPI.
Try to adopt a Zero-trust Philosophy, and focus on strong access control policy.
Today networks are no longer simple, they are more complicated to manage and monitor. Test Your API with DAST (dynamic Application Security Testing) or with other specific products for api security.
Conclusion
APIs impact business and the world around us more than most people realize, even FACEBOOK or META ( if you like to the vintage name ) had their share of an API attack and stated after the Instagram’s API breach that “a number of” celebrity phone number and email addresses had been accessed by “one or more hackers” exploiting and abusing a flaw in its API.
It’s important to understand the common attack types to step ahead into securing yourself.
