The Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing

The Secret Life of APIs: Latest Attack Data Shows What Your APIs Are Doing

Speakers: Rupesh Chokshi, SVP & GM, Application Security, Akamai

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=ccmQXJcc1co

Overview

In an increasingly hyper-connected digital economy, Application Programming Interfaces (APIs) serve as the fundamental backbone for nearly every digital interaction, from booking travel and checking weather to complex business-to-business (B2B) and machine-to-machine communications. This talk, delivered by Rupesh Chokshi, SVP & GM of Application Security at Akamai, delves into the critical and often overlooked security challenges associated with this pervasive technology. Drawing upon extensive research and real-world data from Akamai's global platform, Chokshi highlights the alarming rise in API-targeted attacks and the profound implications for enterprises across all sectors.

The presentation provides a stark look at the current threat landscape, revealing that a significant portion of web attacks now specifically target APIs. Chokshi emphasizes that despite their ubiquity, many organizations struggle with fundamental API security practices, leading to widespread vulnerabilities and data breaches. The talk aims to equip attendees with a data-driven understanding of how adversaries exploit APIs and offers actionable insights into enhancing API security posture, from discovery and visibility to advanced runtime protection and proactive defense strategies.

This article dissects Chokshi's insights, exploring the underlying reasons for API vulnerability, the prevalent attack techniques, and the critical measures organizations must adopt to safeguard their digital ecosystems. It underscores the urgency for a comprehensive, multi-layered approach to API security, moving beyond traditional web application firewalls (WAFs) to solutions that deeply understand business logic and data flows.

Background

▶ Watch: Speaker's opening: importance and research on APIs (1:00)

The proliferation of APIs is a direct consequence of the digital transformation sweeping across industries. Modern applications are inherently modular, relying on a complex web of internal, external, B2B, and B2C APIs to function. Every interaction, from a mobile app querying a backend database to a cloud service communicating with another, involves APIs. This omnipresence, while facilitating unprecedented connectivity and innovation, simultaneously expands the attack surface dramatically.

Historically, security efforts have largely focused on traditional web applications, often relying on Web Application Firewalls (WAFs) to detect and block known malicious patterns. However, APIs present a unique challenge. Unlike traditional web pages with predictable structures, APIs often handle diverse data formats (like JSON and XML), support various authentication mechanisms, and process intricate business logic. This complexity makes them difficult to secure with conventional tools, which may lack the necessary context to understand legitimate versus malicious API calls. The speaker notes that "web application firewall solutions have less insights to investigate the business logic and the data that is served by the APIs" because "API attacks are not pattern bases."

Prior work in API security, notably the OWASP API Security Top 10 list, has attempted to categorize the most common API vulnerabilities. These include issues like Broken Object Level Authorization (BOLA), Broken User Authentication, Excessive Data Exposure, and Lack of Resources & Rate Limiting. Despite these guidelines, many organizations struggle with implementation, often due to a lack of comprehensive visibility into their API landscape, technical debt from legacy systems, or insufficient attention during the development lifecycle. This creates a fertile ground for attackers who are increasingly sophisticated in their methods, moving beyond simple pattern matching to exploit business logic flaws and unauthenticated endpoints.

The problem is exacerbated by the concept of "shadow APIs" – APIs that are developed, deployed, and forgotten, existing outside the purview of security teams. These unmanaged APIs often lack proper authentication, authorization, or patching, turning them into prime targets for exploitation. The rapid pace of development and the distributed nature of modern software architectures further contribute to this challenge, making it difficult for enterprises to maintain an accurate inventory and security posture for all their APIs.

Key Findings

▶ Watch: Akamai's visibility into API attacks and normal traffic (4:00)

Akamai's research, detailed in their State of the Internet (SORI) report, reveals several critical findings regarding the current state of API security:

1. Significant API-Targeted Attacks: A staggering 29% (nearly one-third) of all web attacks observed by Akamai last year specifically targeted APIs. This highlights a clear shift in attacker focus, indicating that APIs are now a primary vector for cyber adversaries.
2. Global Distribution of Attacks: While API attacks are a global phenomenon, the EMEA region (Europe, Middle East, and Africa) experienced the highest percentage of API attacks globally, accounting for almost 47% to 50%. This disproportionate concentration is partially attributed to geopolitical factors and ongoing conflicts in the region, correlating real-world events with cyber activity.
3. Commerce as a Top Target: The commerce industry leads in the volume of API attacks. This is unsurprising given the vast number of transactions, user accounts, and sensitive payment data processed through e-commerce APIs. Financial services and business services also feature prominently among targeted sectors, underscoring the monetary incentives driving these attacks. Even the public sector, including government agencies and school districts, is a significant target due to the sensitive personal data they handle.
4. Prevalence of Traditional and Business Logic Attacks: Attackers frequently leverage tried-and-true methods such as HTTP and JSON attacks, along with credential stuffing. However, a significant portion of attacks exploit more nuanced vulnerabilities like business logic abuse, where legitimate API functionalities are misused for malicious purposes (e.g., loyalty program abuse, carding attacks).
5. Common Security Posture Deficiencies: Key problems identified include poor API posture management, leading to forgotten or "shadow APIs" that are unmonitored and unpatched. Unauthenticated resource access and the exposure of sensitive data in URLs remain persistent issues, allowing attackers to incrementally extract valuable information through trial and error.
6. Runtime Anomalies and Advanced Exploitation: During runtime, common issues include abnormal JSON properties, fuzzy path parameters, and "impossible time travel" scenarios (e.g., a user logging in from one continent and then minutes later from another, indicating account takeover or session hijacking). Data scraping, both legitimate and malicious, is also heavily reliant on API interactions, with attackers using bots to gather inventory, pricing, or personal data for abuse.
7. Visibility as the Foundational Challenge: A primary barrier for organizations is the lack of comprehensive visibility into their API landscape. Many security professionals admit they do not have a full view of all APIs within their enterprise, making effective protection impossible. This highlights the urgent need for automated API discovery and inventory solutions.
8. Shift-Left Momentum: There's a positive trend towards "shift-left" security, integrating API security testing and scanning earlier into the development pipeline. Leveraging runtime intelligence to inform developers about potential vulnerabilities (e.g., BOLA attacks or authentication errors) before deployment can significantly reduce the attack surface.

These findings collectively paint a picture of an evolving threat landscape where APIs are increasingly under siege, demanding a more sophisticated and integrated approach to security.

Technical Deep Dive

▶ Watch: Alarming statistic: 29% of web attacks target APIs (4:40)

The technical nuances of API attacks stem from the very nature of how APIs function and the common pitfalls in their implementation and management. The talk highlights several areas of technical vulnerability and attack vectors:

1. OWASP API Security Top 10 Beyond:

While the OWASP API Security Top 10 provides a foundational understanding, the speaker emphasizes that adversaries go "beyond the top 10." This implies attackers are not just looking for textbook vulnerabilities but are also exploiting subtle misconfigurations, weak business logic, and cumulative errors across API ecosystems. The mention of HTTP and JSON attacks points to the fundamental communication protocols and data formats that are often manipulated. Attackers might inject malicious JSON payloads, malformed HTTP requests, or exploit HTTP verb tampering to bypass security controls.

2. Posture Management Deficiencies:

• Shadow APIs: These are APIs that were developed and deployed but later forgotten or left unmanaged. They often expose outdated functionalities, unpatched vulnerabilities, or default credentials, making them easy targets. Without proper discovery mechanisms, organizations cannot protect what they don't know exists.
• Unauthenticated Resource Access: This occurs when an API endpoint that should require authentication or authorization is left open, allowing anyone to access sensitive data or perform actions. This is a severe vulnerability, often leading to data breaches.
• Sensitive Data in URL: Developers sometimes inadvertently pass Personally Identifiable Information (PII) or other sensitive data directly in URL query parameters. This data can be logged by proxies, browsers, and servers, making it vulnerable to interception, enumeration, and exposure. Attackers often engage in "trial and error," systematically testing URL parameters to extract information like account numbers or social security digits.

3. Runtime Exploitation:

• Abnormal JSON Properties and Fuzzy Path Parameters: APIs expect specific data structures and path formats. Attackers can manipulate JSON payloads (e.g., adding unexpected fields, changing data types) or fuzz API path parameters to trigger errors, bypass input validation, or discover hidden endpoints. Such anomalies can reveal underlying system behavior or expose vulnerabilities.
• Impossible Time Travel: This refers to the detection of geographically impossible sequence of events, such as a user logging in from one location and then, within an impossibly short timeframe, logging in from a distant location. This pattern is a strong indicator of account takeover, session hijacking, or credential stuffing, where multiple attackers might be trying to leverage stolen credentials simultaneously from different locations. Akamai uses AI models and AI engines to detect such anomalies by baselining "ground truth" internet traffic against abnormal patterns.
• Data Scraping: While some scraping is legitimate (e.g., price comparison sites), malicious scraping involves automated bots systematically extracting large volumes of data. This can include competitive pricing data, inventory levels, or user information for loyalty program abuse or credential stuffing attacks. APIs, designed for efficient data exchange, are ideal for this purpose, making it hard to distinguish between legitimate and malicious automated access without deep behavioral analysis.
• Business Logic Abuse: This is a sophisticated attack where an attacker exploits flaws in the application's design or business rules, rather than technical vulnerabilities. Examples include:
• Carding Attacks: As detailed in the talk, attackers use APIs to validate stolen credit card numbers. By repeatedly submitting card details through a payment validation API (e.g., a "buy now" or "add payment method" API), they can determine which cards are active without actually completing a purchase. The entertainment company example demonstrated how an API designed for payment validation was abused to validate tens of thousands of credit cards, which could then be sold on the dark web.
• Loyalty Program Abuse: Attackers can use APIs to automate the process of checking account balances, transferring points, or creating fake accounts within loyalty programs. This can lead to financial losses for businesses and customers.
• Broken Object Level Authorization (BOLA) Attacks: Though not explicitly defined, the speaker mentions BOLA attacks as a known vulnerability that runtime experience can help detect. BOLA (API1:2019) occurs when an API endpoint accepts an object ID as input and performs an action on that object, but fails to properly verify that the authenticated user is authorized to access or modify that specific object. This allows an attacker to manipulate the object ID to access or modify resources belonging to other users.

The common thread across these technical issues is the need for solutions that go beyond simple signature-based detection. They require deep understanding of API specifications, real-time behavioral analytics, and integration throughout the API lifecycle from development to production.

Demo / Proof of Concept

▶ Watch: Geographic distribution: EMEA has highest API attack percentage (7:00)

While the talk did not feature a live technical demonstration or a specific Proof of Concept (PoC) tool in action, the speaker effectively illustrated the impact and mechanics of API attacks through compelling real-world examples and data points. These serve as powerful evidence of the findings and the necessity for robust API security.

A key example provided was the carding attack against an entertainment/television company that offers B2C services. In this scenario, adversaries did not aim to purchase services but rather to exploit the company's payment validation API. They systematically submitted tens of thousands of credit card numbers to the API, which, in its normal business logic, would validate if a card was active or inactive. The attackers leveraged this legitimate API functionality to identify active credit cards, which hold significant monetary value on the dark web. This abuse of core business logic, rather than a direct technical exploit, highlights how attackers can weaponize intended API functionalities. The company faced potential regulatory penalties due to its unwitting role in facilitating a larger fraud scheme.

Another implicitly discussed example involves loyalty program abuse, where attackers use APIs to manipulate or extract information from customer loyalty accounts. While specific details weren't provided, this aligns with the broader theme of business logic abuse, where the API's design for managing loyalty points or accounts is exploited for financial gain or data extraction.

The concept of "impossible time travel" also serves as a compelling "proof of concept" of anomalous behavior detection. When an API call originates from one geographic location, and then minutes later, another API call for the same account originates from a geographically distant location (e.g., United States to Asia), it strongly indicates a compromise or malicious activity. This is not a direct exploit but an observable pattern of abuse that security systems, particularly those employing AI models, can detect as a deviation from normal user behavior.

These examples, drawn from Akamai's extensive visibility across its global network, demonstrate that API attacks are not abstract threats but concrete, impactful events that leverage both technical vulnerabilities and subtle abuses of business logic. They underscore the need for API security solutions that can analyze behavior, understand context, and detect deviations from established baselines rather than just looking for known signatures.

Defensive Implications

▶ Watch: Commerce industry most targeted by API attacks (8:30)

The insights shared in this talk present clear and urgent defensive implications for organizations grappling with API security. A multi-faceted strategy is essential, moving beyond traditional security paradigms to embrace a comprehensive, lifecycle-oriented approach.

1. Prioritize API Discovery and Visibility: The most fundamental step is to gain a complete and accurate inventory of all APIs, both internal and external. As the speaker highlighted, many organizations lack this basic visibility, making them vulnerable to "shadow APIs." Automated discovery tools, integrated into the development pipeline and runtime environment, are crucial. Knowing what APIs exist, their purpose, and their data flows is the bedrock of any effective defense.

1. Implement Robust Posture Management:

• Regular Audits: Continuously audit APIs for misconfigurations, unauthenticated access, and sensitive data exposure (e.g., in URLs).
• Deprecation and Cleanup: Actively identify and decommission old or unused APIs to reduce the attack surface. "Never cleaned it up" is a common problem leading to vulnerable endpoints.
• Authentication and Authorization: Enforce strong authentication mechanisms (e.g., OAuth, API keys) and granular authorization controls for every API endpoint. This directly addresses issues like "unauthenticated resource access" and helps prevent BOLA attacks.

1. Enhance Runtime Protection with Behavioral Analytics:

• Beyond WAFs: Traditional WAFs are insufficient for API security. Organizations need solutions that understand API business logic and data structures.
• Anomaly Detection: Deploy advanced security solutions that use AI models and AI engines to baseline normal API traffic and detect deviations. This can identify "impossible time travel," abnormal JSON properties, and suspicious data scraping patterns.
• Rate Limiting and Abuse Prevention: Implement intelligent rate limiting and bot management to mitigate automated attacks like carding, credential stuffing, and malicious data scraping.

1. Embrace "Shift-Left" Security:

• Integrate Security into Development: Incorporate API security testing (SAST, DAST, IAST for APIs) early in the Software Development Life Cycle (SDLC).
• Developer Education: Educate developers on secure coding practices for APIs, including proper input validation, output encoding, and secure handling of sensitive data.
• Feedback Loops: Leverage runtime intelligence to provide developers with actionable feedback on potential vulnerabilities before APIs reach production, preventing issues like BOLA attacks and authentication errors.

1. Develop a Stronger Offensive Posture:

• Proactive Threat Intelligence: Stay informed about the latest API attack techniques and vulnerabilities. Utilize reports like Akamai's SORI to understand emerging threats.
• Threat Hunting and Red Teaming: Conduct regular penetration testing and red teaming exercises specifically targeting APIs to identify weaknesses before adversaries do.
• Incident Response Planning: Develop and regularly test incident response plans tailored for API-related breaches, including clear communication protocols and remediation steps. The speaker emphasized the importance of a rapid and informed response, deciding whether to block all traffic or implement layered defenses.

1. Leverage Community and Industry Collaboration:

• Information Sharing: Participate in cybersecurity communities and share threat intelligence to collectively raise the bar for API security. The speaker noted a positive trend in "sharing happening in the good side of cybersecurity."
• Industry Standards: Adhere to industry best practices and standards for API development and security.

By adopting these defensive strategies, organizations can move from a reactive stance to a proactive and resilient API security posture, safeguarding their critical digital assets in the face of evolving threats. The speaker's mention of Akamai's acquisition strategy (Neosec, NoName) further underscores the industry's commitment to building comprehensive, specialized API security solutions.

Key Takeaways

• APIs are a Primary Attack Vector: Nearly one-third (29%) of all web attacks observed by Akamai target APIs, highlighting a critical shift in adversary focus.
• Visibility is Foundational but Lacking: Many organizations struggle with basic API discovery and inventory, leading to "shadow APIs" and an inability to protect what they don't know exists.
• Business Logic Abuse is Prevalent: Attackers frequently exploit legitimate API functionalities for malicious purposes, such as carding attacks or loyalty program abuse, often bypassing traditional security controls.
• Shift-Left Security is Essential: Integrating API security testing and best practices early in the development lifecycle, informed by runtime intelligence, can significantly reduce vulnerabilities before production deployment.
• Traditional WAFs are Insufficient: Effective API security requires specialized solutions that can understand deep business logic, analyze behavioral anomalies (like "impossible time travel"), and leverage AI to detect sophisticated threats.
• Comprehensive Posture and Runtime Management are Key: Organizations must focus on both managing their API attack surface (discovery, deprecation, strong authentication) and protecting APIs during operation (anomaly detection, rate limiting, incident response).

About the Speaker(s)

The speaker for this session was Rupesh Chokshi, who holds the position of SVP & GM, Application Security at Akamai. In his role, Chokshi is responsible for leading Akamai's application security business, which encompasses a wide range of solutions designed to protect web applications and APIs from various cyber threats. His insights draw directly from Akamai's extensive global network visibility, threat intelligence, and deep research into evolving attack patterns. Chokshi's expertise is evident in his ability to articulate complex security challenges with real-world examples and data-driven findings, guiding enterprises on how to navigate the intricate landscape of API security. His leadership at Akamai underscores the company's significant investment and strategic focus on addressing the growing threats to APIs.