Application programming interface (API) attacks are attempts to use APIs for malicious or other unsanctioned purposes. They can result from exploiting technical vulnerabilities in API implementations, using stolen credentials and other account takeover techniques to masquerade as legitimate users, and abusing business logic that allows threat actors to use APIs unexpectedly.

Recent studies revealed that in January 2024 alone, attempts to attack web APIs impacted one in 4.6 organizations worldwide per week.

Read More about an API Attack

API attacks come in various forms and, as studies show, have been growing in number since 2023. Learn more about them here.

What Are the Kinds of API Attacks ?

Enabling software and operating systems (OSs) to communicate quickly and easily requires using APIs. But what organizations may not know is that they can’t prevent attacks on APIs with traditional network security solutions. Here are some of the most popular attacks.

  • Machine-in-the-middle attacks: Let hackers quietly intercept communications and requests between two endpoints in a communication channel that allows them to steal sensitive information.
  • Distributed denial-of-service (DDoS) attacks: Let attackers overwhelm an API’s memory by requesting thousands of connections at once, tying up all available resources and causing a crash.
  • Structured Query Language (SQL) injection attacks: Let hackers access software by simply injecting malicious code into poorly developed programs.
  • Insecure API key generation attacks: Let attackers subvert traditional API security tools by generating and using various API keys from a large pool of users.
  • Insufficient logging and monitoring attacks: Let hackers use an initial vulnerability to gain a foothold and search for additional weaknesses. An example would be the January 2024 attack targeting Toyota, Mercedes, BMW, and more than a dozen other car brands.
  • Broken access control attacks: Let attackers access privileged functions to modify or delete website content or steal sensitive data. The January 2023 attack on T-Mobile is an example of this.

What Are the OWASP Top 10 API Risks?

The Open Worldwide Application Security Project (OWASP) identified the top risks APIs can pose.

Broken Object-Level Authorization

This results when any user is granted permission to act on an object. All such actions should be checked, or an API can be vulnerable to data theft or even total account takeover (ATO).

Broken Authentication

This happens when applications permit credential stuffing or brute-force attacks, made possible by using weak passwords or embedding sensitive authentication details like authorization tokens and passwords in URLs.

Broken Object Property Level Authorization

This occurs when APIs allow hosts not only to agree to an action but also to change action details. Users should not be allowed to access objects and their properties. In fact, OWASP recommends that APIs only return the absolute minimum data users need.

Unrestricted Resource Consumption

This results when the responses API grants to requests are not restricted. Successful attacks can render systems unavailable.

Broken Function Level Authorization

This happens when API calls to specific functions aren’t checked for a user’s privileges. As such, low-level users may be able to create new accounts with administrative privileges.

Unrestricted Access to Sensitive Business Flows

This occurs when too many legitimate requests are sent to an API because the action is not restricted.

Server-Side Request Forgery

This results when users are allowed to supply URLs instead of uploading files. Attackers may supply a malicious URL behind a company’s firewall and piggyback on an API’s access permissions to access content they’re not allowed to.

Security Misconfiguration

This happens when APIs are missing security patches, have out-of-date systems or improperly configured cloud permissions, are not encrypted, or have error messages that expose sensitive information.

Improper Inventory Management

This occurs when APIs have data flow blindspots. An example would be not knowing it can access sensitive data and send the information to a third party.

Unsafe Consumption of APIs

This results when a company trusts external APIs more than it should. If the third party is compromised, that external API could send in bad data, causing SQL injection attacks or redirects to malicious locations.

How Can Organizations Protect against API Attacks ?

While it may not be possible for organizations to stop using APIs and thus get exposed to attacks, they can attempt to protect against threats.

Enable Automatic API Discovery

Organizations must automate the continuous discovery of APIs to gain comprehensive visibility into their deployment.

Categorize APIs

Once all APIs in use have been identified, users must categorize them by protocol or architecture. They should then map the sensitive data flows through them to understand their risk exposure.

Keep an API Inventory

Finally, organizations must keep a complete list of APIs. They must encourage software teams to reuse existing APIs since these may have been thoroughly checked for weaknesses.

How to Stop API Attacks

What Is API Security?

API security refers to the methods and tools that protect APIs and mitigate attacks, such as access violations, bot attacks, and abuse. APIs need protection because they can expose application logic, resources, and sensitive data, including personally identifiable information (PII). If attackers access unprotected APIs, they can disrupt business operations, access or destroy sensitive data, and steal intellectual property.

—

The number of attacks targeting the business logic of APIs increased by 10% from 2023 to 2024. The account takeover (ATO) attack volume targeting APIs also increased from 35% in 2022 to 46% in 2023. As API usage grows, so will the number of API attacks.

Key Takeaways

  • API attacks are attempts to use APIs for malicious or otherwise unsanctioned purposes.
  • Machine-in-the-middle, DDoS, and SQL injection attacks are a few examples of such.
  • API security is a must because organizations the world over are not likely to stop using APIs.

Sources

  • https://www.csoonline.com/article/646557/why-api-attacks-are-increasing-and-how-to-avoid-them.html
  • https://www.sec.gov/ix?doc=/Archives/edgar/data/0001283699/000119312523010949/d641142d8k.htm
  • https://www.f5.com/company/blog/nginx/prevent-api-attacks-with-essential-tools-and-best-practices-for-api-security