By Oz Golan, CEO and co-founder of Noname Security
Ransomware attacks have become increasingly sophisticated and prevalent in recent years, posing a significant threat to businesses and organizations of all sizes. These attacks involve cybercriminals encrypting a victim’s data and demanding a ransom payment in exchange for the decryption key. The average cost of a ransomware attack in 2021 was $1.8 million, and this figure is only expected to rise in the coming years.
One of the key reasons why ransomware attacks are so successful is that they take advantage of Application Programming Interfaces (APIs) in the delivery of ransomware and exfiltration data. Strictly speaking, APIs are not susceptible to malware as are traditional hosts. However, APIs often do play a key role in a ransom event, making their security an important part of a ransomware defense strategy.
How are APIs Involved in Ransomware Attacks
There are three primary ways in which API can be directly involved in ransomware attacks.
First, the API itself can be the delivery vehicle for malware to plant ransomware on a host/server. It’s commonplace for us to think about an inbound email campaign with a malicious URL or payload. However, it’s equally necessary to consider that ransomware can also be delivered via API to execute remote code on an unsuspecting host.
Second, an API can be exploited by a ransomware gang to be used as the data exfiltration vehicle, either by using a service/DLL API or by installing new APIs to be used for Command and Control or encryption key management. Again, these are not exploitations of the API, but instead take advantage of an APIs functionality to hide inside the noise of a network’s normal traffic flows. These are particularly difficult for most organizations to discover because they require immediate detection of a new API or new data type trafficked via API. Only a sophisticated, automated API discovery capability can spot the use of these elicit APIs and enable automated blocking of C2 calls or data exfiltration.
Third, ransom gangs can undertake a very effective ransom attack without installing malware at all, merely siphoning data from a leaky API to hold hostage. There are several examples, but most notably the Optus ransom event in Australia. In this event, data stolen from a leaky public API was held for ransom, creating significant long-term organizational impact, but without any installation of ransomware directly on the victim.
How to Protect Your APIs from Ransomware Attacks
There are a number of things that businesses can do to protect their APIs from ransomware attacks. These include:
- Implementing strong API authentication and authorization controls: This will help to ensure that only authorized users can access your APIs.
- Regularly scanning your APIs for vulnerabilities: This will help to identify and fix any vulnerabilities that attackers could exploit.
- Monitoring your APIs for suspicious data movement: This will help to detect and respond to movement of sensitive data outside of approved pathways
- Using API gateways: API gateways can provide an additional layer of security by acting as a middleman between your APIs and the outside world.
- Using a API Security Platform: A purpose-built API security platform will provide key capabilities needed to protect your API attack surface, including testing, discovery, posture management, and runtime controls.
- Educating your employees about API security: This will help them to understand the risks of using APIs and how to protect themselves from attacks.
By taking these steps, businesses can significantly reduce their risk of falling victim to a ransomware attack.
Attackers will try to use any and every potential weakness to execute a successful ransomware attack. The rapid growth of APIs, combined with the potential to exploit them, makes APIs an attractive target for breach attempts. In order to protect themselves, organizations must adopt an API security mindset as a key part of their cybersecurity strategy. As mentioned above, this requires taking steps across the estate, and across teams to address properly. By taking the necessary steps to protect your APIs, you can help to keep your business safe from the growing threat of ransomware attacks.
##
ABOUT THE AUTHOR
Oz Golan is the Co-founder and CEO of Noname Security, the first API Security unicorn startup which was founded in 2020. Previously Oz held multiple leadership positions including Research Team Lead and Director of R&D in the Israeli cybersecurity sector. Before his civilian career, he spent 5 years as a Security Researcher and Developer in Unit 8200 of the Israeli Intelligence Corps. Oz holds a Bachelor of Science in Physics and Computer Science from The Hebrew University of Jerusalem and is currently based in Tel Aviv, Israel.
