Risk
1/16/2013
11:05 PM
50%
50%

Vulnerable APIs Continue To Pose Threat To Cloud

From banks to Instagram, weaknesses in online APIs have caused problems in the last year, with security experts warning that poorly implemented or designed Web APIs could put company data at risk

Cloud services allow third-party access to the application and data through so-called Web application programming interfaces, or APIs. Yet many application developers are failing to properly secure such access, putting the application and underlying data at risk, say security experts.

In October, researchers from the University of Texas at Austin and Stanford University surveyed a variety of high-profile Web services and found that the interfaces exposed to third-party developers contained significant vulnerabilities. Payment services at Amazon and PayPal, the Trillian instant messaging service, the Chase mobile banking service, and other Web applications all have flaws in their implementation of the secure sockets layer (SSL) protocol that weaken their security when accessed through the APIs meant for nonbrowser applications, the researchers found.

The result are applications that can be fooled into allowing some access to a customer's data through the API, according to the paper presented at the 19th ACM Conference on Computer and Communications Security.

"The root cause of most of these vulnerabilities is the terrible design of the APIs to the underlying SSL libraries," the researchers state in the paper.

While the paper was the most comprehensive look into API failings, other incidents drew attention in 2012 as well. In November, security researcher Carlos Reventlov found a vulnerability in the Instagram picture-sharing service that would allow a man-in-the-middle attacker to access or delete a person's photos. In April, Microsoft Research published findings of troubling flaws in the logic used for single sign-on services at Facebook, Google ID, and PayPal.

The solution to the problem is not new technology but an attention to detail, says Christopher Barber, a threat analyst with Solutionary's Security Engineering Research Team (SERT).

"The implementation is not really on the level that we need it to be -- it's very spotty," Barber says. "In software development, you have a deadline for certain functionality, and security always takes a backseat."

[Microsoft Research report shows how risky single sign-on can be without solid integration and better support from Web service providers like Google and Facebook. See Web Services Single Sign-On Contain Big Flaws.]

The pressures to complete a Web application and the complexity of implementing SSL combine to make creating secure APIs particularly challenging. The researchers from UT Austin and Stanford recommend that developers make their APIs and SLL libraries more explicit about how to use them properly. In addition, cloud services should regularly do black-box testing, or fuzzing, against their code to see how the application behaves when an adversary is actively testing it.

By their nature, APIs open the Web application to a much greater risk of attack, says K. Scott Morrison, chief technology officer for Layer 7, a company that helps customers manage their APIs.

"To an attacker, an API can be a very instructive tool in telling how your application is working," he says. "It is very self-describing and gives a road map to the application."

Finally, in addition to getting the encryption right and auditing the application, developers have to worry about identity, who is accessing the API, and what sorts of data will they be allowed to access, he adds. Making the issue more complex, most of the time an application, not a specific person, is accessing the data.

In the end, the hacker-like attitude of many Web developers is not the approach that cloud service providers or their customers should take in dealing with APIs.

"We do a lot of reuse, and some of our bad habits are percolating into the API world," Morrison adds. "Unfortunately, while they are bad in the Web world, they are positively dangerous in the API world."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7241
Published: 2014-12-19
The TSUTAYA application 5.3 and earlier for Android allows remote attackers to execute arbitrary Java methods via a crafted HTML document.

CVE-2014-7249
Published: 2014-12-19
Buffer overflow on the Allied Telesis AR440S, AR441S, AR442S, AR745, AR750S, AR750S-DP, AT-8624POE, AT-8624T/2M, AT-8648T/2SP, AT-8748XL, AT-8848, AT-9816GB, AT-9924T, AT-9924Ts, CentreCOM AR415S, CentreCOM AR450S, CentreCOM AR550S, CentreCOM AR570S, CentreCOM 8700SL, CentreCOM 8948XL, CentreCOM 992...

CVE-2014-7267
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the output-page generator in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7268.

CVE-2014-7268
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the data-export feature in the Ricksoft WBS Gantt-Chart add-on 7.8.1 and earlier for JIRA allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-7267.

CVE-2014-8272
Published: 2014-12-19
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57 does not properly select session ID values, which makes it easier for remote attackers to execute arbitrary commands via a brute-force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.