OWASP API Security Top 10 - API World
•
6 likes•3,752 views
This document outlines the OWASP API Security Top 10 project which identifies the top 10 risks associated with modern application programming interfaces (APIs). It describes each of the top 10 risks, including broken authentication, excessive data exposure, lack of resources and rate limiting, and insufficient logging and monitoring. For each risk, it provides real-world examples of APIs that have been exploited and mitigation strategies are proposed. Additional resources for the project are listed at the end.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to OWASP API Security Top 10 - API World
Similar to OWASP API Security Top 10 - API World (20)
More from 42Crunch
More from 42Crunch (15)
Recently uploaded
Recently uploaded (20)
OWASP API Security Top 10 - API World
- 1. OWASP API Security Top 10
- 2. OWASP API Security Top 10 Erez Yalon Director of Security Research Checkmarx OWASP API Top 10 project lead Dmitry Sotnikov Vice President of Cloud Platform 42Crunch OWASP API Top 10 contributor
- 4. OWASP API Security Top 10 • A1 : Broken Object Level Authorization • A2 : Broken Authentication • A3 : Excessive Data Exposure • A4 : Lack of Resources & Rate Limiting • A5 : Missing Function Level Authorization • A6 : Mass Assignment • A7 : Security Misconfiguration • A8 : Injection • A9 : Improper Assets Management • A10 : Insufficient Logging & Monitoring
- 5. A1: Broken Object Level Authorization
- 6. T-Mobile API Breach (2017) • API behind a web portal • Phone numbers as IDs • Was exploited in the wild (e.g. “SIM swap”) https://www.vice.com/en_us/article/7xkyyz/t-mobile-customer-data-bug-hackers-no-excuse
- 7. A1: Mitigation • Implement authorization checks with user policies and hierarchy • Don’t rely on IDs sent from client. Use IDs stored in the session object. • Check authorization each time there is a client request to access database • Use random non-guessable IDs (UUIDs)
- 9. Balboa hot tubs (2018) • The mobile app controlling the hot tub is invoking the hot tub’s API over the internet • The APIs are “protected” with a shared hardcoded password • Each hot tub comes with an unprotected WiFi hotspot • The APIs use the WiFi hotspot ID as the device identifier https://apisecurity.io/issue-14-hacked-hot-tubs-airlines-trading-sites-json-encoding-best-practices/
- 10. A2: Mitigation • Check all possible ways to authenticate to all APIs • Password reset APIs and one-time links also allow users to get authenticated and should be protected just as seriously • Use standard authentication, token generation, password storage, MFA • Use short-lived access tokens • Authenticate your apps (so you know who is talking to you) • Use stricter rate-limiting for authentication, implement lockout policies and weak password checks
- 11. A3: Excessive Data Exposure
- 12. Uber account takeover (2019) 1. Error message leaking user UUID Request Response https://apisecurity.io/issue-49-uber-account-takeover-leaky-get-api/
- 13. 2. Make a request with the UUID Uber account takeover (2019) Request https://apisecurity.io/issue-49-uber-account-takeover-leaky-get-api/
- 14. Uber account takeover (2019) Response (173 lines!!!) https://apisecurity.io/issue-49-uber-account-takeover-leaky-get-api/ 3. Receive tons of user data including mobile app authentication token
- 15. A3: Mitigation • Never rely on client to filter data • Review all responses and adapt responses to what the API consumers really need • Define schemas of all the API responses • Don’t forget about error responses • Identify all the sensitive or PII info and justify its use • Enforce response checks to prevent accidental data and exception leaks
- 16. A4: Lack of Resources & Rate Limiting
- 17. Instagram account takeover (2019) • Used password reset API • Passcode expires in 10 minutes • Rate limiting 200 / minute / IP • 5000 cloud VMs can enumerate all 6-digit codes • AWS/GCP cost ~ $150 Requesting passcode POST /api/v1/users/lookup/ Host: i.instagram.com q=mobile_number& device_id=android-device-id Verify passcode POST /api/v1/accounts /account_recovery_code_verify/ Host: i.instagram.com recover_code=123456& device_id=android-device-id https://apisecurity.io/issue-40-instagram-7-eleven-zipato/
- 18. A4: Mitigation • Rate limiting • Payload size limits • Rate limits specific to API methods, clients, addresses • Checks on compression ratios • Limits on container resources
- 19. A5: Missing Function Level Authorization
- 20. Gator kids smartwatches (2019) • Simple request of User[Grade] value from 1 to 0 enabled management of all smartwatches https://apisecurity.io/issue-18-security-audits-for-your-api-contracts-google-limits-gmail-api-access/
- 21. A5: Mitigation • Don’t rely on app to enforce admin access • Deny all access by default • Only allow operation to users that belong to the appropriate group or role • Properly design and test authorization
- 23. Harbor (2019) POST /api/users {“username”:”test”,”email”:”test123@gmai.com” ,”realname”:”no name”,”password”:”Password1u0021″,”comment”: null, “has_admin_role”:true} https://apisecurity.io/issue-50-harbor-api-vulnerability-dangers-crud-apis/ • Making yourself an admin
- 24. A6: Mitigation • Don’t automatically bind incoming data and internal objects • Explicitly define all the parameters and payloads you are expecting • For object schemas, use the readOnly set to true for all properties that can be retrieved via APIs but should never be modified • Precisely define at design time the schemas, types, patterns you will accept in requests and enforce them at runtime
- 26. Equifax • Unpatched Apache Struts • Lack of control of Content-Type HTTP header content • Hackers penetrated by sending a crafted header with injection https://apisecurity.io/issue-41-tinder-and-axway-breached-equifax-fined/
- 27. A7: Mitigation • Repeatable hardening and patching processes • Automated process to locate configuration flaws • Disable unnecessary features • Restrict administrative access • Define and enforce all outputs including errors
- 28. A8: Injection
- 29. Samsung SmartThings Hub (2018) • SmartThings Hub is able to communicate with cameras • /credentials API can be used to set credentials for remote server authentication • Data is saved in SQLite database • JSON keys with ; allowed to execute arbitrary queries # using curl from inside the hub, but the same request could be sent using a SmartApp $ sInj='","_id=0 where 1=2;insert into camera values (123,replace(substr(quote(zeroblob((10000 + 1) / 2)), 3, 10000), "0", "A"),1,1,1,1,1,1,1,1,1,1,1,1,1,1);--":"' $ curl -X POST 'http://127.0.0.1:3000/credentials' -d "{'s3':{'accessKey':'','secretKey':'','directory':'','region':'','bucket':'','sessionToken':'${sInj}'},' videoHostUrl':'127.0.0.1/'}" $ curl -X DELETE "http://127.0.0.1:3000/cameras/123" https://www.talosintelligence.com/reports/TALOS-2018-0556/
- 30. A8: Mitigation • Never trust your API consumers, even if internal • Strictly define all input data: schemas, types, string patterns - and enforce them at runtime • Validate, filter, sanitize all incoming data • Define, limit, and enforce API outputs to prevent data leaks
- 31. A9: Improper Assets Management
- 32. JustDial (2019) • India’s largest local search service • Had old unused unprotected API • It was connected to live database • Was leaking 100 mln users’ data https://apisecurity.io/issue-28-breaches-tchap-shopify-justdial/
- 33. A9: Mitigation • Inventory all API hosts • Limit access to anything that should not be public • Limit access to production data. Segregate access to production and non- production data. • Implement additional external controls such as API firewalls • Properly retire old versions or backport security fixes • Implement strict authentication, redirects, CORS, etc.
- 34. A10: Insufficient Logging & Monitoring
- 35. 7-Elevel Japan: 7Pay • Payment app • Password reset allowed email change if personal details were supplied • Attackers used API to try combinations of info for various Japanese citizens • $510K was stolen from 900 customers • The company only noticed after too many users complained https://apisecurity.io/issue-40-instagram-7-eleven-zipato/
- 36. A10: Mitigation • Log failed attempts, denied access, input validation failures, any failures in security policy checks • Ensure that logs are formatted to be consumable by other tools • Protect logs as highly sensitive • Include enough detail to identify attackers • Avoid having sensitive data in logs - If you need the information for debugging purposes, redact it partially. • Integrate with SIEMs and other dashboards, monitoring, alerting tools
- 37. Additional Resources • Details: OWASP API Security Top 10 • PDF: OWASP API Sec cheat sheet • Participate: GitHub Project • Get news and updates: APIsecurity.io • Commercial API sec tools: 42Crunch
- 38. dmitry@42crunch.com | @DSotnikov | 42crunch.com | APIsecurity.io Thank You!