Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

9/12/2019
11:00 AM
100%
0%

APIs Get Their Own Top 10 Security List

OWASP's new list of API weaknesses focuses on issues that have caused recent data breaches and pose common security hazards in modern cloud-based applications.

The Open Web Application Security Project (OWASP) has unveiled its first release candidate for a top 10 list focused on the most critical classes of security issues affecting the communications between online applications, mobile devices, and Web services.

The top issues identified in the API Security Top 10 list, published today, include broken authorization and authentication functions, excessive data exposure, and a failure to focus on rate limiting and resource limiting attacks. While the group's most well-known list — the OWASP Top 10 rankings — focuses on online services and Web application, and includes security issues that are caused by application programming interfaces (APIs), it does not focus on the specific problems plaguing the communications technique, says Erez Yalon, one of the leaders of the API Security Top 10 project and director of security research at software security firm Checkmarx.

"Modern applications that are built on these APIs directly expose the business logic," he says. "Since these APIs are directly exposed, there is a new class of attacks that are specific to APIs. Hence, we have to think about APIs and their security in a whole new way."

Currently labeled as an incubator project, the list focuses on issues that have caused recent data breaches and pose common security hazards in modern cloud-based applications. A number of major data breaches have been caused by cloud infrastructure and Web-based applications that have exposed insecure APIs. 

In 2018, for example, a research fellow with the Mozilla Foundation scraped nearly 208 million transactions on the peer-to-peer payment app Venmo, revealing the purchase profiles of its users— from lovers to weed dealers. In June, another 7 million transactions were scraped using the company's developer API over six months, despite the company's limiting for API calls. The issues exploited by the attack include excessive data exposure and a lack of rate limiting. 

While privacy is often a major casualty of lax API security, insecure API infrastructure can also allow attackers to take control. Just last month, Cisco patched several critical vulnerabilities that could have allowed an attacker to send malicious API requests to the Web management interfaces and compromise its small-business switches and big-data packages. This underscores the hazards of broken authentication mechanisms and broken function-level authorization flaws — both issues on the top 10 list.

"Every modern architecture concept, like mobile, IoT, microservices, cloud environments, and single-page applications, deeply rely on APIs," Yalon says. "The majority of enterprises cite APIs as important to digital transformation and API security as their top challenge."

Publication of the list comes as companies increasingly worry that a combination of the move to developing applications for the cloud and undocumented APIs are leaving their businesses open to attack. Six in 10 companies have more than 400 APIs, and nearly half of companies do not have confidence that they can detect the malicious use of their APIs, according to a survey of 100 security and IT professionals conducted by security firm Ping Identity.

"We're quickly moving from a world where the average enterprise manages a handful of APIs and web services to one where they are contending with thousands of APIs and microservices," said Jason Bonds, vice president of intelligence at Ping Identity, in a statement. "And, these are spanning multiple infrastructure providers and regions around the globe."

For that reason, many API security issues are often hidden, resulting in some serious data breaches. 

In perhaps the worst failure in recent memory, First American Financial allowed anyone with a browser to send requests to its server for sensitive financial documents provided as part of the mortgage process. The documents were serialized — meaning the identifiers incremented in sequence — allowing anyone to harvest 885 million files dating back to 2003

And even when the API itself is secure, many developers inadvertently leak credentials online as part of backing up files to a repository, such as GitHub. Last month, the company — now a subsidiary of Microsoft — revealed its automated scanning service found, in a single year, a billion authentication tokens in the code libraries that developers placed online.

For that reason, companies should make sure they are inventorying their APIs, including requiring DevOps engineers to document a secure process for creating and deploying new API hosts and tracking old APIs, says Checkmarx's Yalon. They also need to review and analyze their authentication and authorization mechanism, as well as the process by which developers modify the code behind the API.

"Having a very clear understanding of the APIs, with a well-maintained inventory and documentation ... is very critical in the world of APIs," Yalon says. "It helps developers prevent shadow APIs and excessive data exposure."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Community Projects Highlight Need for Security Volunteers."

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16863
PUBLISHED: 2019-11-14
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVE-2019-18949
PUBLISHED: 2019-11-14
SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration.
CVE-2011-1930
PUBLISHED: 2019-11-14
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.
CVE-2011-1145
PUBLISHED: 2019-11-14
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
CVE-2011-1488
PUBLISHED: 2019-11-14
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent withi...