Akamai Research Finds 137 Percent Increase in Application and API Attacks

AKAM, news, filings), the cloud company that powers and protects life online, today released a new State of the Internet (SOTI) report that focuses on the increasing proliferation of application and API attacks. Titled, <a href=\"/content/akamai/en/lp/soti/slipping-through-the-security-gaps-the-rise-of-application-and-api-attacks.html\" target=\"_self\"><i>Slipping through the</i> <i>Security Gaps: The Rise of Application and API Attacks</i></a><i>,</i> the report finds that such attacks are growing in both frequency and complexity as adversaries look for more innovative ways to exploit this growing attack surface.</p>\r\n<p>Last year was another record-breaking year for application and API attacks as they grew by 137 percent. This is a major concern since organizations are adopting more web applications and APIs to enhance their business and increase ease of use for customers. The report finds that Local File Inclusion (LFI) remains the top attack vector with year-over-year growth of 193 percent.</p>\r\n<p>The new Akamai research also provides details on several emerging attack vectors such as Server-Side Template Injections (SSTI). With this technique, attackers abuse notable vulnerabilities such as Log4Shell, Spring4Shell and the Atlassian confluence vulnerability. SSTI poses serious business risks as attacks can lead to remote code execution and data exfiltration. Server-Side Request Forgery (SSRF) attacks are another up-and-coming attack vector that poses a substantial threat to organizations. Akamai observes a daily average of 14 million SSRF attempts against our customers’ web applications and APIs.</p>\r\n<p>In addition<i>, Security Gaps: The Rise of Application and API Attacks </i>spotlights Broken Object Level Authorization (BOLA). The top concern in the API threat landscape according to the OWASP API Top 10, BOLA is a simple, yet high risk attack that enables access to the information of other users. The report offers guidance and best practices around mitigating this growing vulnerability.<br>\r\n</p>\r\n<p>Other main findings of the report<i> </i>include:<br>\r\n</p>\r\n<ul>\r\n<li>Attacks on the healthcare industry grew by 82 percent. The adoption of the Internet of Medical Things (IoMT) in the healthcare sector expands the attack surface of this vertical and could lead to increased vulnerabilities.</li>\r\n<li>Median attacks on the manufacturing sector grew by 76 percent due to the proliferation of Internet of Things (IoT) connections and the massive data collected from equipment in this sector. Successful cyberattacks against operating technologies in this industry enable real-world impacts like supply chain issues.</li>\r\n<li>The new proposed OWASP API Top 10 emphasizes the divergence of attack vectors between web applications and APIs.</li>\r\n<li>API attacks directed at the business logic of the API are complicated to detect and mitigate and cannot be determined at the individual request level.&nbsp; Pre-existing knowledge is required, such as the specific business logic and the resources accessible by each user.</li>\r\n<li>Webshells allow for a simple and effective way to interact with web servers as they are stealthier than regular shells and present an attractive arsenal for attackers. Trending webshells discussed in the report include the <a href=\"https://attack.mitre.org/software/S0020/\">China Chopper</a> and Behinder webshells.</li>\r\n</ul>\r\n<p>“As cybercriminals evaluate who provides the best return on investment based on the level of effort, the value of data or the likelihood of paying extortion, we often see shifts in attack trends,” said Rupesh Chokshi, Senior Vice President<i> </i>and General Manager, Application Security at Akamai. “<i>Security Gaps: The Rise of Application and API Attacks </i>offers insight into the attacks that organizations should be most concerned about and provides mitigation strategies for countering these threats such as stopping vectors at the edge, segmentation and patching.”<br>\r\n</p>\r\n<p>For additional information, the security community can access, engage with, and learn from Akamai’s threat researchers by visiting the <a href=\"/content/akamai/en/security-research.html\" target=\"_self\">Akamai Security Hub</a> and following the team on Twitter at <a href=\"https://twitter.com/akamai_research\" target=\"_blank\" rel=\"nofollow noreferrer\">@Akamai_Research</a>.</p>\r\n"}}">

 Akamai Technologies, Inc. (NASDAQ: AKAM), the cloud company that powers and protects life online, today released a new State of the Internet (SOTI) report that focuses on the increasing proliferation of application and API attacks. Titled, Slipping through the Security Gaps: The Rise of Application and API Attacks, the report finds that such attacks are growing in both frequency and complexity as adversaries look for more innovative ways to exploit this growing attack surface.

Last year was another record-breaking year for application and API attacks as they grew by 137 percent. This is a major concern since organizations are adopting more web applications and APIs to enhance their business and increase ease of use for customers. The report finds that Local File Inclusion (LFI) remains the top attack vector with year-over-year growth of 193 percent.

The new Akamai research also provides details on several emerging attack vectors such as Server-Side Template Injections (SSTI). With this technique, attackers abuse notable vulnerabilities such as Log4Shell, Spring4Shell and the Atlassian confluence vulnerability. SSTI poses serious business risks as attacks can lead to remote code execution and data exfiltration. Server-Side Request Forgery (SSRF) attacks are another up-and-coming attack vector that poses a substantial threat to organizations. Akamai observes a daily average of 14 million SSRF attempts against our customers’ web applications and APIs.

In addition, Security Gaps: The Rise of Application and API Attacks spotlights Broken Object Level Authorization (BOLA). The top concern in the API threat landscape according to the OWASP API Top 10, BOLA is a simple, yet high risk attack that enables access to the information of other users. The report offers guidance and best practices around mitigating this growing vulnerability.

Other main findings of the report include:

• Attacks on the healthcare industry grew by 82 percent. The adoption of the Internet of Medical Things (IoMT) in the healthcare sector expands the attack surface of this vertical and could lead to increased vulnerabilities.
• Median attacks on the manufacturing sector grew by 76 percent due to the proliferation of Internet of Things (IoT) connections and the massive data collected from equipment in this sector. Successful cyberattacks against operating technologies in this industry enable real-world impacts like supply chain issues.
• The new proposed OWASP API Top 10 emphasizes the divergence of attack vectors between web applications and APIs.
• API attacks directed at the business logic of the API are complicated to detect and mitigate and cannot be determined at the individual request level.  Pre-existing knowledge is required, such as the specific business logic and the resources accessible by each user.
• Webshells allow for a simple and effective way to interact with web servers as they are stealthier than regular shells and present an attractive arsenal for attackers. Trending webshells discussed in the report include the China Chopper and Behinder webshells.

“As cybercriminals evaluate who provides the best return on investment based on the level of effort, the value of data or the likelihood of paying extortion, we often see shifts in attack trends,” said Rupesh Chokshi, Senior Vice President and General Manager, Application Security at Akamai. “Security Gaps: The Rise of Application and API Attacks offers insight into the attacks that organizations should be most concerned about and provides mitigation strategies for countering these threats such as stopping vectors at the edge, segmentation and patching.”

For additional information, the security community can access, engage with, and learn from Akamai’s threat researchers by visiting the Akamai Security Hub and following the team on Twitter at @Akamai_Research.