By Musa Nadir Sani
API popularity and usage have grown exponentially in the past 12 months, helping businesses push out more complex and dynamic products. APIs have become the backbone of the internet as they play a crucial role in digital transformation. They allow for a fast exchange of data and information between applications, containers, and microservices, providing consumers with increased convenience on their digital devices.
The increase in popularity has also led to an increase in attacks. Malicious API attack traffic surged 117% over the past year.
Most companies have applied security practices that address common attacks such as SQL and XSS injections, MiTM attacks, and DDoS. But API-specific attacks are different, and the existing security stack can’t see them. Often, the attack vector involves the exploitation of Zombie APIs.
What is a Zombie API?
A “zombie API” is an outdated API that has been left unused or forgotten. At some point, it served a purpose, but it may now be obsolete or replaced with a newer version.
Suppose a company needs proper management of API versioning, depreciation, and retiring old APIs. In that case, these APIs can persist indefinitely between being alive and dead, leaving room for manipulation and exploitation.
What is a Supply Chain Attack?
A supply chain attack (also known as a third-party attack or value-chain attack) is necessarily one that happens during the production of a company’s goods. These API attacks may or may not have anything to do with that company’s supply chain.
Zombie APIs and the impact on Supply Chains
Zombie APIs can significantly impact organizations and their related systems and services. Zombie APIs can be vulnerable to exploitation, and other security threats, such as injection attacks, credential stuffing, and parameter attacks. These APIs may still be connected to critical systems, making them an attractive target for attackers looking to compromise sensitive information.
Asides from security risks, zombie APIs can also impact the performance and reliability of an organization’s systems or software. Outdated or forgotten APIs can lead to compatibility issues and software errors, causing systems to become unstable and unreliable, or even lead to a DDoS attack when software is intentionally overloaded with API calls. This can disrupt the overall functionality of the software and its service, leading to delays and disruptions in transferring important data and, at large, affecting the software’s supply chain.
Zombie APIs can also result in financial losses. For example, suppose an API connected to a financial system is compromised. In that case, an attacker may access sensitive financial information, such as credit card numbers or bank account information, leading to financial losses for the organization and its customers. Also, by affecting software performance and reliability, organizations that offer some form of SaaS can incur losses when clients cannot use their software optimally.
Solution(s)
Zombie APIs can be avoided by implementing API lifecycle management. API lifecycle management involves APIs’ planning, development, testing, deployment, and retirement. It allows organizations to keep track of their APIs and ensure they are up-to-date, secure, and functional.
API management is essential for organizations that rely on multiple APIs to connect their systems, as a vulnerability in one API can have far-reaching consequences. By keeping track of their APIs and ensuring that they are up-to-date and secure, organizations can avoid the creation of zombie APIs and the associated risks.
The API management lifecycle comprises four (4) stages.
Planning and development: API lifecycle management should start with the planning and development stage, where organizations should determine their API needs and create a roadmap for their API development. This stage should also involve selecting appropriate technologies and tools for API development and management.
Testing: The testing stage ensures that APIs are functional and meet the organization’s requirements. This stage should involve testing APIs for compatibility, performance, and security.
Deployment: The deployment stage can begin once the testing stage is complete. This stage involves the deployment of APIs to production systems, where customers and other stakeholders can use them. Organizations should also ensure that they have proper security measures to protect their APIs and connected systems.
Retirement: Finally, the retirement stage is where organizations can retire APIs that are no longer needed or have been replaced with updated versions. This stage should involve the removal of APIs from production systems and preserving relevant documentation and data for future reference.
Conclusion
Following the SolarWinds attack in 2020, more focus has been placed on the risks associated with the supply chain. Organizations have expanded their security scope to cater to other organizations and software within their supply chain. Zombie APIs, however, pose a new kind of risk. With API traffic steadily increasing daily, emphasis should be placed on API lifecycle management and runtime API security. Companies must oversee their APIs’ planning, development, testing, deployment, and retirement, ensuring they are up-to-date, secure, and functional. This holistic approach will give organizations a comprehensive view of their API ecosystem and mitigate the emergence of Zombie APIs, allowing for more practical and secure software and systems.
##
ABOUT THE AUTHOR
Musa is a certified Cybersecurity Analyst and Technical writer. He has experience working as a Security Operations Center (SOC) Analyst and Cyber Threat Intelligence Analyst (CTI) with a history of writing relevant cybersecurity content for organizations and spreading best security practices. He is a regular writer at Bora.
His other interests are Aviation, History, DevOps with Web3 and DevSecOps. In his free time, he enjoys burying himself in a book, watching anime, aviation documentaries and sports, and playing video games.
