API vulnerabilities are a huge target for cyber criminals, report finds
Application programming interface (API) vulnerabilities are proving to be a high-stakes game for companies and individuals worldwide, according to new Akamai Technologies research titled 'API: The Attack Surface That Connects Us All'.
According to the researchers, APIs are inherently designed to be fast and easy pipelines between different platforms.
While this priority on convenience and user experience leads APIs to be highly essential to many businesses, it also makes them appealing targets for cyber criminals, the researchers state.
Akamai's report highlights the frustrating patterns of API vulnerabilities, despite the improvements that have been made in Software Development Life Cycles (SDLCs) and testing tools.
Often, API security is relegated to an after thought in the rush to bring them to market, with many organisations relying on traditional network security solutions that are not designed to protect the wide attack surface that APIs can introduce, Akamai states.
The researchers highlight that it's not always clear where API vulnerabilities live. For example, APIs are often hidden within mobile apps, leading to the belief that they are immune to manipulation.
Developers make the assumption that users will only interact with the APIs via the mobile user interface (UI), but, as noted in this report, that's not the case.
Also detailed in the report, Akamai reviewed 18 months of attack traffic between January 2020 and June 2021, finding more than 11 billion total attempted attacks.
With 6.2 billion attempts on record, SQL Injection (SQLi) remains at the top of the web attack trending list, followed by Local File Inclusion (LFI) with 3.3 billion, and Cross-Site Scripting (XSS) with 1.019 billion.
While difficult to pinpoint the above attacks in terms of the percentage of purely API attacks, the Open Web Application Security Project (OWASP), a nonprofit foundation that works to improve the security of software, recently released an API Security Top 10 list, which mirrored Akamai's findings.
Additional report highlights include that credential stuffing attacks tracked across the 18 months between January 2020 and June 2021 remained steady, with single day peaks of over 1 billion attacks recorded in January 2021 and May 2021.
In addition, DDoS traffic remained consistent in 2021 so far, with peaks recorded earlier in Q1 2021. In January 2021, Akamai recorded 190 DDoS events in a single day, followed by 183 in March.
Akamai security researcher and author of the State of the Internet / Security report, Steve Ragan, says, "From broken authentication and injection flaws, to simple misconfigurations, there are numerous API security concerns for anyone building an internet-connected application.
"API attacks are both underdetected and underreported when detected. While DDoS attacks and ransomware are both major issues, attacks on APIs don't receive the same level of attention, in large part because criminals use APIs in ways that lack the splash of a well-executed ransomware attack, but that doesn't mean they should be ignored."
Veracode chief research officer Chris Eng says, "Compare the OWASP Top 10 to the OWASP API Security Top 10. The latter purports to address the unique vulnerabilities and security risks of APIs, but look closely and you'll see all of the same web vulnerabilities, in a slightly different order, described with slightly different words.
"To add more fuel to the fire, API calls are easier and faster to automate (by design!) a double-edged sword that benefits developers as well as attackers.
