Investigating Recent Breaches

One of the best ways to learn is through the experience of others, particularly if these experiences come with deleterious consequences. Unfortunately, in the case of API security, there is no shortage of breaches and security incidents from which to learn.

In this chapter, we will look at a number of real-world API breaches, gaining an appreciation of how poor design decisions and implementation flaws allowed a skilled attacker to exploit the API, often with serious consequences. Explore this chapter with an open mind and consider, at each point, the decisions made and how you would have done things differently. Remember that hindsight is 20/20 – it’s not always as easy as it might seem.

In this chapter, we will examine several recent real-world breaches, focusing on the following areas:

• What happened with the incident?
• What was the root cause of the incident?
• What was the impact of the incident?
• How can such incidents...

The importance of learning from mistakes

Previously, in my career as an application security consultant in large organizations, I struggled to convey the importance of a particular security concept or principle to a development team. Although developers can appreciate the theory of an underlying issue (for example, SQL injection), there can be a perception that the issue is not a real-world example and would not occur in practice. The most powerful tactic in such cases is to provide a practical hands-on demonstration of the vulnerability, and then, even more impactful, is to demonstrate how this issue impacted an organization by showcasing details of a breach or incident.

We are living in an age of greater transparency in the disclosure of security incidents, thanks to the advent of responsible disclosure initiatives and managed bug bounty programs. Organizations are far more likely to disclose the nature of a breach and the actions they have taken to prevent a recurrence, rather...

Examining 10 high-profile API breaches from 2022

In my professional role, I produce a weekly newsletter on API security topics at APISecurity.io (https://apisecurity.io/). From my work at APISecurity.io, I have picked ten of the top breaches from 2022, which give a representative sample of real-world API vulnerabilities and how they lead to the loss of data or personal information. Let’s get started.

Errors and omissions excepted

Information in this section is taken from publicly disclosed sources, including bug reports, vulnerability tracking sites, first- and third-party blogs and research sites, and industry news websites.

To the best of the my knowledge, the information is accurate at the time of writing; however, as is the nature of technology, the landscape changes rapidly, and new information or details may have come to light in the interim.

1–Global shipping company

In February 2022, security researchers at Pen Test Partners disclosed details of...

Key takeaways and learning

Hopefully, by now, you understand how easily API vulnerabilities can be exploited. Although none of the vulnerabilities featured resulted in dire consequences or financial loss, this is in some cases down to good fortune.

Firstly, the root cause of nearly all the flaws in the APIs resulted from either human error (where developers made basic mistakes) or a lack of security skills (where developers lacked an understanding of how their APIs could be attacked). Both can be addressed by developer training in the form of computer-based lessons or instructor-led courses.

Secondly, many of the vulnerabilities could have been avoided in the first place using a combination of secure design (threat modeling and risk assessments), secure coding best practices, and, most importantly, testing at every stage of the software development life cycle.

Thirdly, most of the attacks used simple methods and were unsophisticated in nature. Certainly, no advanced tools...

Summary

We have covered a lot in this chapter. By now, you should have a good understanding of how APIs can be attacked and how sometimes benign flaws can lead to severe compromise. On a note of caution, we have seen how easily flaws can be introduced and, likewise, how easily an attacker can use these flaws to compromise a system. On a more optimistic note, many of the flaws covered can easily be detected early in the development life cycle and, with education and sound design principles, can be avoided entirely.

With our sound grounding in the fundamentals of APIs, let’s focus on how APIs can be attacked in the next section.

Further reading

Further reading on DevOps principles is available here:

• https://postmortems.pagerduty.com/culture/blameless/
• https://blog.sonatype.com/principle-based-devops-frameworks-three-ways

Further reading on API security is available here:

• https://apisecurity.io/
• https://apisecurity.io/encyclopedia/content/owasp/owasp-api-security-top-10.htm