Introduction
In in the present day’s interconnected digital ecosystem, Software Programming Interfaces (APIs) play a pivotal function in enabling seamless communication and information trade between numerous software program purposes and techniques. APIs act as bridges, facilitating the sharing of data and functionalities. Nonetheless, as the usage of APIs continues to rise, they’ve turn out to be an more and more enticing goal for cybercriminals and a major cybersecurity danger throughout numerous industries. This text dives into the world of APIs, exploring why they pose substantial cybersecurity challenges and offering real-world examples of API breaches throughout completely different sectors.
Obtain API Safety Information.
The API Revolution
The proliferation of cloud computing, cell apps, and the Web of Issues (IoT) has accelerated the adoption of APIs. They function the constructing blocks of recent software program purposes, enabling builders to combine third-party providers, improve functionalities, and create modern options quickly. From prolonged healthcare providers to e-commerce, APIs have turn out to be an integral a part of our digital lives.
Why APIs are a Cybersecurity Danger
On the API facet, the top-ranked vulnerability cited by the Open Net Software Safety Challenge (OWASP) is now BOLA, or damaged object-level authorization. This flaw can enable attackers to control the ID of an object in an API request, in impact letting unprivileged customers learn or delete one other consumer’s information. This can be a significantly high-risk assault, provided that it does not require any diploma of technical talent to execute, and intrusions resemble regular site visitors to most security techniques.
Detection logic should differentiate between 1-to-1 connections and 1-to-many connections amongst sources and customers. Publish-event BOLA assaults are tough to see due to their low quantity, and it doesn’t present a robust indication of any behavioral anomalies, resembling injection or denial of service.
2023 studies point out cyberattacks concentrating on APIs have jumped 137%, with healthcare and manufacturing seen as prime targets by attackers. Attackers are particularly within the latest inflow of latest gadgets beneath the Web of Medical Issues and related apps and API ecosystem that has supported the supply of extra accessible affected person care and providers. One other trade that can also be weak is manufacturing, which has skilled a rise in IoT gadgets and techniques, resulting in a 76% enhance in media assaults in 2022.
Nonetheless, in keeping with a latest State of API Safety 2023 report, the next are security groups’ prime checklist of API security issues:
- Zombie APIs – Previous, deprecated APIs generally known as Zombie APIs appeared on the prime of the checklist of API security issues in lots of 2023 studies
- DDoS – Denial of service (DDoS) assaults to overwhelm web site, server, or community
- Authentication Bypass – Account takeover/misuse
- Data Leakage – Unintended publicity of delicate information
- Data exfiltration – Unintentional publicity of information that’s intentionally stolen
- Shadow APIs – Undocumented “backdoor” APIs (e.g., unknown or shadow APIs)
The Proliferation of APIs Throughout Industries
The explosion of APIs throughout industries has been pushed by their unparalleled skill to boost connectivity, streamline operations, and allow innovation. Organizations are leveraging APIs to realize interoperability, speed up growth cycles, and supply enhanced consumer experiences. From e-commerce platforms integrating fee gateways to healthcare techniques sharing affected person information securely, APIs allow organizations to harness the strengths of specialised providers and applied sciences with out having to reinvent the wheel.
The modularity and extensibility provided by APIs empower builders to construct upon present functionalities, quickly create new purposes, and adapt to evolving market calls for. As industries proceed to embrace digital transformation, APIs play a pivotal function in driving effectivity, agility, and competitiveness, fostering a dynamic ecosystem of interconnected applied sciences.
Listed below are just a few examples of how main industries are utilizing APIs and the dangers related to not securing APIs appropriately.
Healthcare
Healthcare establishments are more and more harnessing the ability of APIs to revolutionize affected person care and improve operational effectivity. APIs are serving as a conduit for seamless information trade amongst numerous healthcare techniques, enabling interoperability between digital well being data (EHR) platforms, medical gadgets, and affected person portals. These APIs facilitate safe and standardized sharing of affected person info, permitting healthcare professionals to entry essential information on the level of care.
Furthermore, APIs are driving innovation in telemedicine and distant affected person monitoring by enabling real-time communication between sufferers and medical practitioners by way of cell apps and wearables. By leveraging APIs, healthcare establishments aren’t solely optimizing scientific workflows and lowering administrative burdens but in addition bettering affected person engagement and outcomes. Using APIs in healthcare is fostering a extra related and data-driven ecosystem, in the end remodeling the way in which healthcare providers are delivered and skilled.
Some analysis states that the shortage of security APIs might trigger $12 billion to $23 billion in common annual API-related cyber loss within the US and wherever from $41 billion to $75 billion globally.
Whereas APIs supply vital advantages to the healthcare trade, additionally they introduce potential dangers. Insufficient security controls in API implementations can result in unauthorized entry to delicate affected person information, exposing people to privateness breaches and id theft. To mitigate these dangers, healthcare establishments should prioritize sturdy API security measures, together with encryption, robust authentication, common vulnerability assessments, and compliance with trade laws resembling HIPAA.
Quest Diagnostics API Breach: A 3rd-party API was the results of one of many largest data breaches skilled by a number one scientific laboratory service supplier in the US, Quest Diagnostics. Attackers exploited a vulnerability on this third-party’s net fee web page, which was accessible by way of an uncovered API gaining unauthorized entry to medical info of roughly 11.9 million sufferers.
Monetary Service Establishments
Monetary establishments are leveraging APIs to revolutionize their providers and buyer experiences. APIs have turn out to be the spine of recent monetary techniques, enabling seamless integration between numerous banking features, third-party purposes, and digital providers. With APIs, these establishments can supply clients real-time entry to account info, transaction histories, and customized monetary insights. APIs additionally facilitate safe fee processing, enabling the combination of cell wallets and third-party fee gateways.
Furthermore, monetary establishments are embracing Open Banking initiatives, permitting clients to securely share their monetary information with licensed third-party purposes by way of standardized APIs. This strategy fosters innovation by enabling fintech corporations to develop tailor-made options resembling budgeting apps, funding platforms, and lending providers. By means of APIs, monetary establishments aren’t solely bettering operational effectivity but in addition remodeling the way in which clients work together with and handle their monetary affairs, making a extra dynamic and interconnected monetary panorama.
API attackers concentrating on monetary providers and insurance coverage APIs are more and more lively, with a reported 244% enhance in distinctive assaults in 2022. As well as, many monetary establishments have skilled a major security problem in manufacturing APIs over the previous 12 months, and almost one out of 5 have suffered an API security breach.
As a consequence of this, on October 3, 2022, the FFIEC introduced a major replace to its 2018 Cybersecurity Useful resource Information for Monetary Establishments. Including API Safety as an essential element of a company’s stock of data techniques and danger administration initiatives.This can be a main growth towards the eventual regulatory mandates, together with API security.
Latitude Monetary API Breach: The Melbourne-based firm, which gives private loans and bank cards in Australia, suffered a significant breach that occurred in March 2023, with greater than 14 million data being compromised. Nearly 8 million drivers’ licenses have been stolen, together with 53,000 passport numbers and dozens of month-to-month monetary statements. Essentially the most regarding facet of the breach is that Latitude Monetary initially reported that solely 300,000 folks have been affected, suggesting a lack of know-how of the assault.
Know-how
Tech corporations are on the forefront of leveraging APIs to create modern and interconnected options that drive the digital financial system. These corporations make the most of APIs for a mess of functions, together with bettering and enhancing consumer experiences, increasing product functionalities, and collaborating with exterior builders. This speedy growth and integration of APIs can result in security oversights.
Tech corporations usually handle quite a few APIs from numerous sources and guaranteeing constant security practices throughout all of them might be difficult. An oversight in a single API might open the door to vulnerabilities that attackers might exploit to compromise the broader community. For instance, the combination of third-party APIs can expose tech corporations to dangers past their management. If a third-party API is compromised, it will probably impression the security of the built-in utility, as seen within the 2018 Fb breach, the place a third-party app’s vulnerability uncovered consumer information.
Nonetheless, the rising reliance on APIs poses vital cyber dangers to tech corporations since APIs usually transmit delicate info between techniques. Any vulnerabilities in API security may very well be exploited to realize unauthorized entry to consumer information or firm databases, and insufficient authentication and authorization mechanisms can expose APIs to assaults like unauthorized information retrieval or manipulation.
Dropbox API Breach: On November 1, 2022, hackers have been in a position to acquire entry to Dropbox’s GitHub inner code repositories. This allowed hackers to entry 130 inner code repositories, some containing API keys and consumer information. Hackers despatched an e-mail emulating CircleCI, a well-liked pipeline for CI/CD, for his or her phishing assault. Customers have been then taken to a counterfeit CircleCI web page, the place they have been prompted to enter their GitHub credentials. They have been then despatched a One-Time Password, which they have been requested to enter.
Luckily, it appears no consumer information was accessed within the DropBox API breach. The hackers have been restricted to downloading GitHub’s code repositories, which is unhealthy information for them however higher information for DropBox customers.
Retail
Retailers in the present day do greater than half of their enterprise on-line and have embraced the usage of APIs to revolutionize their operations and ship enhanced buyer shopping for experiences. This trade leverages APIs to seamlessly join their on-line and in-store techniques, combine third-party providers, and optimize numerous points of their enterprise processes. For retail corporations, APIs facilitate real-time stock administration throughout a number of areas, enabling clients to test product availability on-line earlier than visiting a bodily retailer. Moreover, APIs energy customized suggestions, enabling retailers to recommend merchandise based mostly on buyer preferences and searching historical past, thereby enhancing cross-selling and upselling alternatives.
In most retail sectors in the present day, APIs play an important function in streamlining the ordering and supply processes. Cell apps and web sites usually combine with point-of-sale techniques by way of APIs, enabling clients to position orders remotely and obtain correct updates on their orders’ standing. Third-party integrations, though enhancing performance, introduce a further layer of danger if APIs connecting with third-party providers are uncovered.
Peleton API Breach: In Might 2021, a security researcher discovered that he might make unauthenticated requests to Peloton back-end APIs that have been utilized by associated train tools and subscription providers. One might name the Peloton API endpoints immediately and acquire vital quantities of PII, leading to privateness impacts for Peloton clients. Peloton net and cell purposes created as companions to Peloton train tools used these back-end APIs to offer exercise statistics and sophistication scheduling. Peloton in the end remedied the API points, nevertheless it’s unclear what number of Peloton clients might have had their private info disclosed.
Conclusion
APIs have reworked the way in which software program purposes work together and performance, providing effectivity and innovation throughout industries. Nonetheless, their widespread use has additionally launched new and complicated cybersecurity challenges. The potential for unauthorized information entry, disruption of providers, and compromise of whole techniques makes APIs a primary goal for cybercriminals. As seen from the examples above, insufficient API security controls can result in vital breaches with far-reaching penalties.
To mitigate the dangers posed by APIs, organizations should prioritize sturdy security measures. This contains implementing robust authentication and authorization mechanisms, often updating and patching APIs, encrypting delicate information throughout transit and conducting thorough security assessments, resembling penetration testing and code critiques. Moreover, organizations ought to set up complete security protocols for integrating third-party APIs and guarantee ongoing monitoring to detect and reply to potential threats.
Finest Practices and Mitigation
BreachLock recommends that organizations severely think about updating their API security practices, that ought to embrace the next:
- Attack Floor Administration – API discovery and stock by way of Attack Floor Administration scanning for each inner and external-facing assault surfaces
- API Penetration Testing Companies – Common API security assessments to determine vulnerabilities by way of hybrid penetration testing, utilizing each automated and handbook applied sciences
- Continued Automated Testing – API risk prevention by way of continued automated security validation to make sure security controls are efficient and new vulnerabilities haven’t emerged
If developments proceed, new API exploits shall be skilled extra ceaselessly. At BreachLock, we imagine API security needs to be a major cyber initiative for all organizations to make sure that your security ecosystem can defend in opposition to some of these refined and rising assaults.
About BreachLock
BreachLock is a world chief in PTaaS and penetration testing service. BreachLock gives automated, AI-enabled, and human-delivered options in a single built-in platform based mostly on a standardized built-in framework that allows constant and common benchmarks of assault methods, security controls, and processes. By making a standardized framework, BreachLock can ship enhanced predictability, consistency, and correct ends in real-time each time.
