Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

9/12/2019
11:00 AM
100%
0%

APIs Get Their Own Top 10 Security List

OWASP's new list of API weaknesses focuses on issues that have caused recent data breaches and pose common security hazards in modern cloud-based applications.

The Open Web Application Security Project (OWASP) has unveiled its first release candidate for a top 10 list focused on the most critical classes of security issues affecting the communications between online applications, mobile devices, and Web services.

The top issues identified in the API Security Top 10 list, published today, include broken authorization and authentication functions, excessive data exposure, and a failure to focus on rate limiting and resource limiting attacks. While the group's most well-known list — the OWASP Top 10 rankings — focuses on online services and Web application, and includes security issues that are caused by application programming interfaces (APIs), it does not focus on the specific problems plaguing the communications technique, says Erez Yalon, one of the leaders of the API Security Top 10 project and director of security research at software security firm Checkmarx.

"Modern applications that are built on these APIs directly expose the business logic," he says. "Since these APIs are directly exposed, there is a new class of attacks that are specific to APIs. Hence, we have to think about APIs and their security in a whole new way."

Currently labeled as an incubator project, the list focuses on issues that have caused recent data breaches and pose common security hazards in modern cloud-based applications. A number of major data breaches have been caused by cloud infrastructure and Web-based applications that have exposed insecure APIs. 

In 2018, for example, a research fellow with the Mozilla Foundation scraped nearly 208 million transactions on the peer-to-peer payment app Venmo, revealing the purchase profiles of its users— from lovers to weed dealers. In June, another 7 million transactions were scraped using the company's developer API over six months, despite the company's limiting for API calls. The issues exploited by the attack include excessive data exposure and a lack of rate limiting. 

While privacy is often a major casualty of lax API security, insecure API infrastructure can also allow attackers to take control. Just last month, Cisco patched several critical vulnerabilities that could have allowed an attacker to send malicious API requests to the Web management interfaces and compromise its small-business switches and big-data packages. This underscores the hazards of broken authentication mechanisms and broken function-level authorization flaws — both issues on the top 10 list.

"Every modern architecture concept, like mobile, IoT, microservices, cloud environments, and single-page applications, deeply rely on APIs," Yalon says. "The majority of enterprises cite APIs as important to digital transformation and API security as their top challenge."

Publication of the list comes as companies increasingly worry that a combination of the move to developing applications for the cloud and undocumented APIs are leaving their businesses open to attack. Six in 10 companies have more than 400 APIs, and nearly half of companies do not have confidence that they can detect the malicious use of their APIs, according to a survey of 100 security and IT professionals conducted by security firm Ping Identity.

"We're quickly moving from a world where the average enterprise manages a handful of APIs and web services to one where they are contending with thousands of APIs and microservices," said Jason Bonds, vice president of intelligence at Ping Identity, in a statement. "And, these are spanning multiple infrastructure providers and regions around the globe."

For that reason, many API security issues are often hidden, resulting in some serious data breaches. 

In perhaps the worst failure in recent memory, First American Financial allowed anyone with a browser to send requests to its server for sensitive financial documents provided as part of the mortgage process. The documents were serialized — meaning the identifiers incremented in sequence — allowing anyone to harvest 885 million files dating back to 2003

And even when the API itself is secure, many developers inadvertently leak credentials online as part of backing up files to a repository, such as GitHub. Last month, the company — now a subsidiary of Microsoft — revealed its automated scanning service found, in a single year, a billion authentication tokens in the code libraries that developers placed online.

For that reason, companies should make sure they are inventorying their APIs, including requiring DevOps engineers to document a secure process for creating and deploying new API hosts and tracking old APIs, says Checkmarx's Yalon. They also need to review and analyze their authentication and authorization mechanism, as well as the process by which developers modify the code behind the API.

"Having a very clear understanding of the APIs, with a well-maintained inventory and documentation ... is very critical in the world of APIs," Yalon says. "It helps developers prevent shadow APIs and excessive data exposure."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Community Projects Highlight Need for Security Volunteers."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16860
PUBLISHED: 2019-11-19
Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local machine could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an ele...
CVE-2019-16861
PUBLISHED: 2019-11-19
Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated ...
CVE-2014-5118
PUBLISHED: 2019-11-18
A Security Bypass Vulnerability exists in TBOOT before 1.8.2 in the boot loader module when measuring commandline parameters.
CVE-2019-12422
PUBLISHED: 2019-11-18
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2012-4441
PUBLISHED: 2019-11-18
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.