Using & Abusing APIs: An Examination of the API Attack Surface
•
7 likes•2,659 views
Web APIs offer organizations new channels to reach customers and extend their businesses, but they also offer new opportunities for abuse. In this presentation we identify the identities, attack surfaces and threats (both new and old) that security professionals need to be aware of in the new world of Web APIs.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Similar to Using & Abusing APIs: An Examination of the API Attack Surface
Similar to Using & Abusing APIs: An Examination of the API Attack Surface (20)
More from CA API Management
More from CA API Management (20)
Recently uploaded
Recently uploaded (20)
Using & Abusing APIs: An Examination of the API Attack Surface
- 1. Using and Abusing APIs An Examination of the API Attack Surface Ronnie Mitra Principal API Architect - Europe Layer 7 API Academy
- 4. API Academy Mike Amundsen Ronnie Mitra
- 5. Web APIs
- 9. Tunnel Style URI Style Hypermedia Style Event Driven Style
- 10. Tunnel Style Example: SOAP • transport agnostic • operation based • binding documents (WSDL)
- 14. Hypermedia Style
- 15. Hypermedia Style • links • templated input (forms) • task based
- 16. { links: [ link {href: ‘…’ rel: ‘list’}, link {href: ‘…’ rel: ‘add’} ] collection: [ {link: {rel:'complete',href:‘…'}, id:42, text:‘Record 42' } ] }
- 17. Event Driven Style Example: WebSockets • event based communication • server initiated events • full-duplex (websocket)
- 19. Private or Closed APIs
- 22. Public or Open APIs
- 26. Tunnel URI Hypermedia Event-Driven Private Public
- 27. Web APIs: New and Exciting! http://www.flickr.com/photos/every1knows/4191971139
- 28. “Web APIs? I’ve been doing that for years.” Image courtesy of http://www.flickr.com/photos/en321/3902138429/
- 29. Web APIs offer us a new perspective http://www.flickr.com/photos/mugley/4407790613
- 30. The Modern Philosophy of the Web API: • self service • lower barriers and lower costs • developer-centric
- 31. All hail the developer king
- 33. Primary Challenge: How do we control usage without impacting usability?
- 34. Attack Surfaces
- 37. API End User
- 38. Injection Attacks Utilizing input parameters to inject data that compromises the security of the targeted system. Examples: - SQL Injection - Command Injection - Code Injection - Argument Injection
- 39. API Attack Example: SQL Injection Attacks: APIs GET http://host.com/aresource?token= %E2%80%98or%20%E2%80%981%3D1 GET http://host.com/aresource?token=‘ or ‘1=1 select * from tokens where token = ‘’ or ‘1=1’;
- 40. APIs May Be A Direct Conduit 40 HTTP Server App Server Database App Objects Often: • Self-documenting • Closely mapped to object space
- 41. Denial Of Service Attacks An attack which has the objective of making a service unavailable to all users Examples: - XML/JSON parser attacks - Jumbo messages - Server overload
- 42. Overflow Attack Intentionally sending too much data in order to exploit a target systems by exceeding expected boundaries. Examples: Buffer Overflow Cash Overflow
- 43. Cross Site Scripting (XSS) Attack Embedding code within a server that will be transmitted to users.
- 44. XSS API Example 44 Attacker Web App Server (browser+APIs) Victim: Web Browser Client <SCRIPT …> 1. API injects script in 3. Browser loads content with embedded script 2. Server fails to perform FIEO: Filter Input, Escape Output API
- 45. Interception of communication between two systems. Man in the Middle Attack
- 46. TLS OAuth 2 Open ID Connect
- 48. Impersonating a registered application in order to access an API resource. Examples: - Guessing application ID by brute force - Retrieving application ID by sniffing traffic - Cracking application to retrieve application ID App Spoofing
- 49. New platforms, new languages: • Ruby on Rails • Node.js • Scala • Nginx • Squid/Varnish/Traffic Manager
- 50. Portal
- 51. Who is using the API? How are they using it?
- 52. What would happen if the portal was exploited?
- 55. Where are the components deployed? Who owns the identity store?
- 56. Portal API
- 58. API API API
- 59. Summary: Challenge: Balancing Usability and Security Old Threats Still Exist New Styles and Access Models create new surfaces
Editor's Notes
- By our definition, a Web API includes SOAP, REST, HTTP, CSV… just about any type of interface deployed over the web.
- Hypermedia is like building a browser based web for computer programs.You can follow linksYou can provide input based on templatesRather than mapping to a resource + operations you can follow tasks.
- Hypermedia is like building a browser based web for computer programs.You can follow linksYou can provide input based on templatesRather than mapping to a resource + operations you can follow tasks.
- Hypermedia is like building a browser based web for computer programs.You can follow linksYou can provide input based on templatesRather than mapping to a resource + operations you can follow tasks.
- Make a slide with an example
- Make a slide with an example
- In many ways the web API space has become synonymous with a culture of modernity and hipness.
- Often times when speaking about APIs to architects who’ve “been around the block” you get a response that there is nothing new in this web API stuff.Maybe you felt that way? I know that in the early days, when I first heard the term I dismissed it as an attempt at rebranding existing technologies.
- The developer is the new king.The rise of the developerThe importance of the dev. has grownGood Devs have the power to build the applications that will drive popularity of a service.Influential devs have the power to drive adoption of your service.Attracting talented developers has become a design goal
- Different identities
- Different identities
- A major form of attack is the injection attack.
- Just like websites, APIs expose parameters and fields that can be manipulated. As long as there is an SQL based database somewhere in the integration chain you need to mitigate this risk.
- A major form of attack is the injection attack.
- A major form of attack is the injection attack.
- A major form of attack is the injection attack.
- Similar to the SQL injection attack, this attack allows an attacker to execute malicious code on the target system. In this example an exposed redirect parameter has been used to force the server’s PHP interpreter to retrieve and execute the attacker’s code.
- Similar to the SQL injection attack, this attack allows an attacker to execute malicious code on the target system. In this example an exposed redirect parameter has been used to force the server’s PHP interpreter to retrieve and execute the attacker’s code.
- Different identities
- Different identities