Cybercriminals Ramp Up Attacks on Web APIs

As more organizations use application programming interfaces for Web applications, attacks and security incidents targeting APIs continue to grow.

Attacks on Web applications continue to grow, with the majority of malicious activity focused on Web application programming interfaces, or Web APIs, researchers report.
The findings, released Oct. 27 by Internet security firm Akamai, call out the growing attack surface posed by Web APIs. Researchers dont actually differentiate between attacks on Web applications and attacks specifically using Web APIs but maintain that the growing attacks on Web applications are mainly coming through the APIs exposed by application servers. The top three Web attack vectors — SQL injection, local file inclusion, and cross-site scripting — account for nearly 95% of all Web attacks and often are carried out through APIs, according to Akamais report.
While developers are quickly adopting APIs as a way of architecting mobile, Web, and cloud applications, they dont always consider security, says Akamai security researcher Steve Ragan.
The lessons that Web application security [professionals] learned a decade ago, we are now seeing them in API security, he says. APIs are meant to increase the availability and access at scale. They are easy to deploy, so developers really love to tack on APIs when they can, [but] because APIs are dominating our lives, it is important to pay attention to their security.
The growing attack surface area of Web APIs is not going unnoticed. Market research firm Gartner maintains that 90% of Web applications will be more vulnerable to attacks through exposed APIs than through the user interface,
according to Akamais report
. Another report, published by
API security firm Salt Labs
, says overall API traffic increased by more than 140% in the first half of the year, but malicious API traffic grew much faster, by nearly 350%.
The growing use of Web APIs by attackers led the Open Web Application Security Project (OWASP) to
release a list of the Top 10 API security issues in 2019
. In many ways, the issues on this list mirror those on the better-known OWASP Top 10 Web Application Security Risks list.
The [Top 10 API Security list] purports to address the unique vulnerabilities and security risks of APIs, but look closely and you’ll see all of the same web vulnerabilities, in a slightly different order, described with slightly different words, Chris Eng, chief research officer for software security firm Veracode, said in an essay in the report. Were making all the same mistakes with API security that we made with web security 20 years ago.
The Akamai report documents a slow increase in daily Web application attacks over the last 18 months, with the month of June 2021 showing a more significant peak, exceeding 113 million attacks in a single day. In addition, the average number of credential-abuse attacks, in which the attacker attempts to log in using stolen or guessable credentials, has also tripled over the past 18 months. Many of those attacks could be conducted through an applications API.
Going forward, you are going to see APIs as the first scans, when they are looking for entry into corporate networks, Ragan says. When they do credential stuffing attacks, they are using the APIs, and a lot of that stuff is not rate-limited, so you are seeing unlimited guesses.
Surveys have shown developers are more focused on getting APIs working than making sure the interfaces are secure, according to Akamais report. About half of software development teams regularly push out code known to have vulnerabilities, with half pointing to a need to meet a critical deadline and an expectation that they would later patch the feature,
according to a report by the Enterprise Strategy Group sponsored by Veracode
.
Dont ignore the vulnerabilities, dont ignore the testing, dont hardcode passwords and tokens, Ragan says. All of those basics, you are still seeing those problems. We are seeing a lot of the problems now that we saw years ago, and it is completely avoidable.
In addition to attacks targeting APIs and Web applications, Akamai also saw credential stuffing attacks rise to an average of about 800 million fraudulent login attempts per day in the first half of 2021, with a handful of days seeing 1 billion login attempts.
Distributed denial-of-service (DDoS) attacks grew as well: Akamai recorded 190 DDoS events in a single day in January, but attacks dropped off in June.
Attackers targeted networks and systems in the United States about six times as much as targets in the second most targeted nation, the United Kingdom. However, the US is also the source of the most attacks, accounting for four times the volume of attacks than the second most common source, Russia.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cybercriminals Ramp Up Attacks on Web APIs