TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Application Protection Report 2019, Episode 5: API Breaches and the Visibility Problem

2019-08-13 · Read original ↗

ATT&CK techniques detected

4 predictions
T1190Exploit Public-Facing Application
96%
"other open source office suites like libre office and openoffice. 26 - / v1 / agent / self or / v1 / agent / service / register – these two paths are targeting a remote command execution vulnerability in the hashicorp consul service mesh api. the exploit for this vulnerability wa…"
T1190Exploit Public-Facing Application
78%
"log _ browser / validate – this is another path whose intended target and function we do not understand, but we can reasonably guess that it was targeting the api of network traffic logging, server logging, or similar appliance, possibly for the purposes of network reconnaissance…"
T1525Implant Internal Image
70%
"##s. because they are not intended for human use, apis are often set up to access any data within the application environment. permissions are usually set up for the user making the original request, and these permissions are, in turn, passed to the api. that is all well and good…"
T1525Implant Internal Image
32%
"and data translation role, coordinating disparate and distributed functions behind the scenes to present the user with a unified application service. from a security standpoint, this is what really matters : the user experience is that of one app. in other words, apis raise the s…"

Summary

API use has grown tremendously as applications grow more decentralized. Some large apps have hundreds of APIs, and mobile apps depend on them completely.