API Attacks: Understanding and Protecting Your Infrastructure

API attacks have become a growing concern in today’s digital landscape.

In essence, APIs are designed to offer efficient access to data. However, if hackers successfully compromise an API, they could swiftly exfiltrate a substantial amount of data. Cyber hackers do this by exploiting vulnerabilities and misconfigurations in API endpoints to gain unauthorized access. This ensures substantial data exposure, creates a massive disruption of services, and can wrench open the door to other malicious activities for your organization.

This is why understanding the different types of API attacks is crucial for implementing effective security measures. If you are more interested in learning the core basics of what API security entails before jumping into this blog, read part I of our new API series, “What is API Security?”

In this special API attacks focused article, we overview 8 common API attack vectors, and discuss key ways you can protect your infrastructure.

Here is a list of the 8 API attack vectors we’ll be covering in this blog article:

1: Injection Attacks
2: DoS/DDoS Attacks
3: Authentication Hijacking
4: Data Exposure
5: Parameter Tampering
6: Man in the Middle (MitM)
7: Unencrypted Communications
8: Application Abuse

Let’s dive in!

8 API attack vectors to watch out for in 2024

API abuse is rife.

In 2023, malicious actors frequently exploited the following vulnerabilities in data breach incidents due to their common occurrence. In CybelAngel’s 2024 State of the External Attack Surface Report, we review in an in-depth use case how T-Mobile’s cyberattack breach in 2023 was the result of unauthorized access to a single Application Programming Interface (API).

You can read more analysis as well as security best practices from CybelAngel’s CISO, Todd Carroll, in our annual report here.

As a result, the compromise of personal, financial, and health information of millions of users and consumers has been observed as a consequence of API attack vectors.

1: Injection attacks

Injection attacks involve embedding malicious code into unsecured software systems. While these attacks have historically targeted web applications, they are increasingly being directed at APIs as well.

How to prevent injection attacks?

Poor input validation or insufficient sanitization of user-supplied data allows attackers to execute unauthorized commands or inject malicious scripts into API endpoints. To prevent injection attacks, it is essential to implement robust input validation and data sanitization techniques.

2: DoS/DDoS attacks (Distributed Denial of Service Attacks)

Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks aim to render a targeted system unavailable to its intended users. API endpoints have become prime targets for such attacks, leading to costly service disruptions, downtime, and potential reputational damage.

How to prevent DoS/DDoS attacks?

Implementing traffic monitoring and mitigation strategies can help protect against these attacks, ensuring the availability of your APIs. CISA recommends that cybersecurity teams “create a disaster recovery plan to ensure successful and efficient communication, mitigation, and recovery in the event of an attack” to stay one step ahead.”

3: Authentication hijacking

Authentication hijacking occurs when attackers bypass or break the authentication methods employed by a web application. By exploiting authentication vulnerabilities, attackers can gain unauthorized access to protected resources and compromise user accounts.

Just last year, a significant vulnerability in the Expo open-source framework exposed a critical flaw in its API, enabling attackers to acquire authentication credentials through the Open Authorization (OAuth) protocol. Following this incident, named CVE-2023–28131, cybersecurity recommendations for developers were shared via Medium.

How to prevent authentication hijacking?

Implementing robust authentication mechanisms, such as multi-factor authentication, can mitigate the risk of authentication hijacking.

4: Data exposure

APIs often handle sensitive data such as credit card information, passwords, and sensitive information like patient health records, employee data, and customer files.

Here is a non exhaustive list of what that sensitive data can look like:

• Credit card security codes and expiration dates
• Debit card number and codes
• Bank account numbers and verification codes
• Customer login credentials
• Tax IDs
• Insurance scores
• Customer PII records
• Employee PII data

If an application fails to handle this data correctly, it becomes vulnerable to data exposure. Encryption of data in transit and at rest is simply crucial for API security. It is also crucial from a brand and financial perspective that this sensitive data is protected in with extensive security measures. The fines involved if not are rather hair raising. Within the the EU, severe violations, listed in Art. 83(5) GDPR, can mean a fine of up to 20 million euros, or in the case of an undertaking, up to 4 % of their total global turnover of the preceding fiscal year, whichever is higher.

How to prevent data exposure?

There are many ways to prevent data exposure, including through robust API discovery, which we will cover in an upcoming blog article.

One proven method is to implement Transport Layer Security (TLS) to ensure that data exchanged through your APIs is encrypted, safeguarding its confidentiality and integrity.

5: Parameter tampering

In a parameter tampering attack, attackers manipulate the parameters exchanged between the client and server.

The OWASP have described an example: “Consider a user who can select form field values (combo box, check box, etc.) on an application page. When these values are submitted by the user, they could be acquired and arbitrarily manipulated by an attacker.”

How to prevent parameter tampering?

Modifying critical application data allows attackers to subvert the intended functionality of the application and gain unauthorized privileges or financial advantages.

What is more is that by implementing strong validation and integrity checks on API input parameters can help mitigate the cybersecurity risk of parameter tampering attacks.

6: Man in the Middle (MitM)

In an API MitM attack, the attacker intercepts the communication between an API endpoint and a client. This allows them to steal confidential information or alter transmitted data, compromising the integrity of the system.

One recent example of this API attack vulnerability concerned Microsoft in 2023.

An Azure Active Directory (AD) app was found to have an abandoned reply URL address. This situation could have allowed an attacker to redirect authorization codes to themselves, thus gaining access to fraudulently obtained authorization codes. Subsequently, the attacker could exploit this by using Microsoft’s Power Platform API via a middle-tier service to gain elevated privileges and launch attacks. The issue, once reported by a third party, was quickly resolved in less than 24 hours.

How to prevent MitM attacks?

Implementing secure communication protocols and using encrypted connections, such as HTTPS, can protect against MitM attacks, as well as continuous monitoring.

In the specific case of MitM API attacks, CISA recommends that cybersecurity teams:

• Employ multiple network and browser protection methods

They recommend this as it “forces an attacker to develop different tactics, techniques, and procedures to circumvent the new security configuration.”

7: Unencrypted Communications

Proper encryption is a fundamental security measure that should be applied to secure APIs. Unwisely, many organizations still use APIs without encryption, leaving API vulnerabilities open to hackers.

How to prevent attacks targeting unencrypted communications?

As simple as it seems, via encryption! Without it hackers can easily intercept and manipulate the data passing through the API, to swiftly compromise the confidentiality and integrity of the information exchanged.

8: Application Abuse

Specific industries may face unique API cyberattack threats tailored to their targeted applications. For instance, in the travel industry, competitors may deploy bots that pose as customers, denying inventory for legitimate users. We discuss this in part 1 of our API Security blog series, which you can read here.

Mitigating such application-specific abuses requires specialized security measures beyond traditional solutions.

Compared to web application security, identifying bots accessing an API can be challenging.

Why is this?

Traditional Web Application Firewalls (WAFs) struggle to detect and block these attacks as they primarily focus on abnormal request patterns. There are limits to what a WAF can do, as the profile of an API is different from what a WAF traditionally protects against. It is essential to accurately identify and block malicious bots, along with implementing comprehensive security measures to ensure robust API protection.

How to prevent application abuse API attacks?

Protecting against app abuse is crucial for maintaining the security, availability, and integrity of web applications.

Organizations must implement:

• Secure coding practices
• Secure communication protocols
• Data encryption
• Strong authentication mechanisms
• Regular cybersecurity assessments

Another important challenge is staying updated on emerging threats and monitoring for suspicious activities are vital for effective API protection. By adopting a comprehensive approach to API security, organizations can safeguard their systems, protect sensitive data, and provide a secure user experience.

4 OWASP best practices to prevent API attacks

According to OWASP, also known as the Open Source Foundation for Application Security, there are actions your cybersecurity teams can take:

• When evaluating service providers, assess their API security posture
• Ensure all API interactions happen over a secure communication channel (TLS)
• Always validate and properly sanitize data received from integrated APIs before using it
• Maintain an allowlist of well-known locations integrated APIs may redirect yours to: do not blindly follow redirects

Final thoughts on API attack vectors

Hopefully, this list reviewing the 8 types of api attacks has clarified important risk areas for you and your cybersecurity processes, as API attack vectors evolve.

API attacks are rising. Examples of targeted platforms include Github, which CybelAngel continuously scans 24/7 to identify exposed API keys, passwords, access credentials, and other potential vulnerabilities. We detail more about this concern in our CybelAngel 2024 State of the External Attack Surface Report, which you can download here.

In the long run, API security, in particular API discovery helps cybersecurity teams to:

• Monitor API attack threats
• Protect and defend their brands against data exposures and sensitive information leaks

Discover more about the evolution of API attack threats in our five part API Security blog series. To follow along, check out our LinkedIn, and Twitter.