Risk
1/16/2013
11:05 PM
Connect Directly
RSS
E-Mail
50%
50%

Vulnerable APIs Continue To Pose Threat To Cloud

From banks to Instagram, weaknesses in online APIs have caused problems in the last year, with security experts warning that poorly implemented or designed Web APIs could put company data at risk

Cloud services allow third-party access to the application and data through so-called Web application programming interfaces, or APIs. Yet many application developers are failing to properly secure such access, putting the application and underlying data at risk, say security experts.

In October, researchers from the University of Texas at Austin and Stanford University surveyed a variety of high-profile Web services and found that the interfaces exposed to third-party developers contained significant vulnerabilities. Payment services at Amazon and PayPal, the Trillian instant messaging service, the Chase mobile banking service, and other Web applications all have flaws in their implementation of the secure sockets layer (SSL) protocol that weaken their security when accessed through the APIs meant for nonbrowser applications, the researchers found.

The result are applications that can be fooled into allowing some access to a customer's data through the API, according to the paper presented at the 19th ACM Conference on Computer and Communications Security.

"The root cause of most of these vulnerabilities is the terrible design of the APIs to the underlying SSL libraries," the researchers state in the paper.

While the paper was the most comprehensive look into API failings, other incidents drew attention in 2012 as well. In November, security researcher Carlos Reventlov found a vulnerability in the Instagram picture-sharing service that would allow a man-in-the-middle attacker to access or delete a person's photos. In April, Microsoft Research published findings of troubling flaws in the logic used for single sign-on services at Facebook, Google ID, and PayPal.

The solution to the problem is not new technology but an attention to detail, says Christopher Barber, a threat analyst with Solutionary's Security Engineering Research Team (SERT).

"The implementation is not really on the level that we need it to be -- it's very spotty," Barber says. "In software development, you have a deadline for certain functionality, and security always takes a backseat."

[Microsoft Research report shows how risky single sign-on can be without solid integration and better support from Web service providers like Google and Facebook. See Web Services Single Sign-On Contain Big Flaws.]

The pressures to complete a Web application and the complexity of implementing SSL combine to make creating secure APIs particularly challenging. The researchers from UT Austin and Stanford recommend that developers make their APIs and SLL libraries more explicit about how to use them properly. In addition, cloud services should regularly do black-box testing, or fuzzing, against their code to see how the application behaves when an adversary is actively testing it.

By their nature, APIs open the Web application to a much greater risk of attack, says K. Scott Morrison, chief technology officer for Layer 7, a company that helps customers manage their APIs.

"To an attacker, an API can be a very instructive tool in telling how your application is working," he says. "It is very self-describing and gives a road map to the application."

Finally, in addition to getting the encryption right and auditing the application, developers have to worry about identity, who is accessing the API, and what sorts of data will they be allowed to access, he adds. Making the issue more complex, most of the time an application, not a specific person, is accessing the data.

In the end, the hacker-like attitude of many Web developers is not the approach that cloud service providers or their customers should take in dealing with APIs.

"We do a lot of reuse, and some of our bad habits are percolating into the API world," Morrison adds. "Unfortunately, while they are bad in the Web world, they are positively dangerous in the API world."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7392
Published: 2014-07-22
Gitlist allows remote attackers to execute arbitrary commands via shell metacharacters in a file name to Source/.

CVE-2014-2385
Published: 2014-07-22
Multiple cross-site scripting (XSS) vulnerabilities in the web UI in Sophos Anti-Virus for Linux before 9.6.1 allow local users to inject arbitrary web script or HTML via the (1) newListList:ExcludeFileOnExpression, (2) newListList:ExcludeFilesystems, or (3) newListList:ExcludeMountPaths parameter t...

CVE-2014-3518
Published: 2014-07-22
jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to exec...

CVE-2014-3530
Published: 2014-07-22
The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via...

CVE-2014-4326
Published: 2014-07-22
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in (1) zabbix.rb or (2) nagios_nsca.rb in outputs/.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Where do information security startups come from? More important, how can I tell a good one from a flash in the pan? Learn how to separate ITSec wheat from chaff in this episode.