Vices & Devices - How IoT & Insecure APIs Became the New Cyber Battlefront
Download as PPTX, PDF0 likes128 views
1. APIs have seen huge growth in usage, with over 25% of all internet traffic now consisting of API calls, largely driven by mobile apps and the growing IoT ecosystem. 2. Attackers have shifted focus to targeting APIs due to their simplicity and accessibility, exploiting common vulnerabilities like credential stuffing and application layer attacks against APIs developed with modern lightweight frameworks. 3. One campaign analyzed by Akamai showed attackers attempting 4 times as many stolen credentials through APIs compared to standard web logins, using over 4 times as many unique IP addresses per API-based campaign. 4. The rise of IoT devices has introduced new attack vectors, with credential abuse campaigns now exploiting vulnerable IoT devices like routers
Vices & Devices - How IoT & Insecure APIs Became the New Cyber Battlefront
- 1. Ory Segal Senior Director, Threat Research Akamai VICES AND DEVICES How IoT & Insecure APIs Became the New Cyber Battlefront
- 2. AGENDA: ⢠APIs Overview & History ⢠AKAMAI Security visibility & scale ⢠API statistics from the Akamai platform ⢠Credential abuse attack overview ⢠APIs credential abuse campaigns ⢠SSHowDowN IoT device attacks
- 3. APPLICATION PROGRAMMING INTERFACE A software design approach which enables developers to integrate with other systems based on a defined set of communication methods. APIs serve as software building blocks and allow for software reuse essentially allowing fast development of new systems based on existing capabilities
- 4. BRIEF HISTORY OF API TECHNOLOGIES 0 10 20 30 40 50 60 70 80 90 100 Interestovertime 20072004 2010 20162013 CORBA SOAP SERVICES UDDI WSDL RESTful SERVICES JSON APIs MICROSERVICES
- 5. OPEN & SIMPLE The same openness & simplicity that make APIs attractive to developers also make APIs an attractive target for attackers
- 6. Š2017 AKAMAI | FASTER FORWARDTM The Intelligent Platform ⢠220,000+ Edge Servers ⢠3,315+ Locations ⢠1200+ Cities ⢠129 Countries ⢠1,227+ Networks The Data ⢠3 trillion hits per day ⢠1 Billion unique IPs seen quarterly ⢠13+ trillion log lines per day ⢠260+ terabytes of compressed daily logs 15 - 30% of all web traffichttp://wwwnui.akamai.com/gnet/globe/ http://tech.akamai.com/attack-globe/ AKAMAI
- 7. AKAMAIâS SECURITY VISIBILITY Akamai Intelligent Platform Akamai Intelligent Platform Cloud Security Intelligence Visibility â15-30% of global web traffic â3 Trillion Hits/Day â550M Daily logins monitored Data â40B daily security eventsâ700,000 log lines a second â20 TB new attack data daily Analysis âDedicated threat research team â100 automated heuristics â6M botnets monitored daily
- 8. 144.7BHTTP requests 36.6B API Calls 25% of all traffic - API calls! 65%Mobile APIs 35% AJAX, Web, Other
- 9. 28% 23% 23% 10% 8% 5% 3% High Technology Online Retail Media Gaming Hotel & Travel Financial Services Other API Usage (By Industry)
- 10. 51% 36% 11% 0% 0% 2% 25% 56% 10% 4% 2% 3% JSON Form-Data XML Plain Text Binary Other Request Content-Type (APIs vs. Standard Web) Standard Web API Calls 51% OF API CALLS USE JSON! Not all security protections are suitable for deep inspection of attacks within complex JSON messages
- 11. TOP ATTACK VECTORS AFFECTING API ENDPOINTS Application Layer Attacks Attacks targeting application logic â SQL Injection, Cross-Site Request Forgery, XSS, etc. Denial of Service Mass-scale attempts to exhaust system resources and deny service from others Content Scraping Illegitimate data mining and content harvesting Credential Abuse (âCredential Stuffingâ) Mass-scale account abuse, either by brute- force guessing, or by using leaked credentials 76% 13% 6% 3% 2% 0.01% SQL Injection Local File Include Code Injection Command Injection XSS Remote File Include
- 12. 413.4MLogin requests 27.9MUnique IP Addresses 48.7KInternet Hosts 42% Only API Calls (JSON, XML, SOAP) 55% Only Forms Login 3% Use Both 78% Mobile Logins 22% Browsers, IoT
- 14. Password Another password ONE MORE PASSWORD Password YET ANOTHER PASSWORD The average user uses over 50 different services requiring a password People have limited memory (and they are often lazy) Password Password PEOPLE USE THE SAME PASSWORD EVERYWHERE
- 15. It only takes one site to leak... EVEN THE MOST TRUSTED SERVICES HAVE BEEN BREACHED
- 17. TOOLS OF THE TRADE
- 18. 413.4MLogin requests 27.9MUnique IP Addresses 48.7KInternet Hosts 30%Of all login requests are malicious
- 19. CAMPAIGN ANALYSIS 1,000,000 4,000,000 Standard Web APIs Average Campaign Size (By Number of Accounts) ATTACKERS ATTEMPT x4 MORE STOLEN ACCOUNTS THROUGH API 88% OF ATTACKERS PERFORMED API-BASED ATTACKS! x4.75 MORE IPs (Avg.) PER CAMPAIGN IN APIs
- 20. API LOGINS: THE PERFECT TARGET Complexity of deep API message inspection: The Non-standard message formats of API calls make it hard for security solutions to detect attacks. Attacks remain unseen {API} Drawbacks of web âAnti- Automationâ solutions: Most anti-automation solutions apply protections that are irrelevant in the API ecosystem: ⢠HTTP anomalies ⢠CAPTCHA ⢠JS challenges & fingerprinting ⢠Rate limits Limited visibility: Security products that are not API-centric, do not provide proper logging and visibility into API attacks Lack of proper API management: Many orgs. deploy hundreds of APIs, each exposing a multitude of endpoints. Managing these APIs is a daunting task. Hackers are constantly on the lookout for ârogue APIsâ Operational simplicity: APIs provide granular interfaces to backend software functions. Their consumption in a programmatic way is extremely simple. Adversaries recently started using undocumented APIs intended to be used by mobile applications.
- 21. SSHowDowN On IoT Devices & Credential Abuse Attack Campaigns
- 22. 1M-bot campaign demonstrated ~25% of IPs as âsingle useâ (no repeat activity) Over 1 month, ~70% of the IPs only attacked 1 day REAL WORLD: FINSERV CAMPAIGN
- 23. â°How come we see such a high % of âsingle useâ attack machines â°How come the work load (checked accounts) is balanced so well among so many bot nodes? (no repeated account attempts) â°How come we see large networks of attacking machines that are Routers, Hotspots, CCTV systems and other IoT devices? OPEN QUESTIONS?
- 24. A single source is generating the traffic â explains why it is identical A single source runs over the list of accounts â explains why work is not repeated Large proxy lists are easy & cheap to maintain â much more than a botnet A single attacker is routing login traffic using round robin over a long list of machines serving as proxies Missing piece â Whatâs the deal with IoT devices? SPECULATION:
- 25. CCTVs Routers Servers Satellite Antennas(?!) ADSL/Cable Modems Hotspots MANY SOURCE IPs EXPOSED A WEB INTERFACE
- 28. Search for ESTABLISHED TCP Connections Seems like the SSH daemon is responsible for many active HTTP/HTTPS connections â some of which are to Akamai Ghost machines
- 29. DEFAULT ACCOUNT CANNOT âSSHâ INTO MACHINE
- 30. No active shell sessions seen â not under ârootâ or âadminâ users The âadminâ user (which has the default admin:admin credentials) has /sbin/nologin configured â so an attacker canât SSH into the machine and run commands Was SSHD tampered with and contains a backdoor? We checked - No... HOW IS SSH USED FOR THESE ATTACKS?
- 31. All traffic passes through the SSH server, as if you setup a VPN through SSH but without shell permissions on the server <AllowTcpForwarding yes> (default) USING SSH AS SOCKS PROXY WHEN USER HAS NO SHELL PERMISSIONS
- 32. Attacker Vulnerable IoT Device Target Web Server SSH TUNNEL /> ssh âD 8080 âN cctv_admin@iot.vuln (requires âdefaultâ account credentials) /> curl --proxy socks5h://localhost:8080 http://target.site/ Malicious HTTP SOCKS PROXY SSHowDowN INSTRUCTIONS MANUAL:
- 33. SSH TUNNEL 1 SSH TUNNEL 2 SSH TUNNEL n .... Attacker Vulnerable IoT Device Target Web Server FROM PROXY TO CLOUD/BOTNET:
- 34. VULNERABLE DEVICES SPOTTED âIN THE WILDâ
- 35. Š2017 AKAMAI | FASTER FORWARDTM And the Cherry on the Cake....
- 36. ACCESSING INTERNAL NETWORK MACHINES IP of an internal machine
- 37. 2. Access an Internal machine (in this example â over HTTP) 1. Create an SSH Proxy Tunnel:
- 38. SUMMARY
- 39. 1. Huge growth in API usage (>25% of all traffic) ⢠Mobile apps are the #1 driver ⢠Device & app integration. IoT ecosphere is a perfect example 2. Simple & accessible APIs, developed with modern lightweight frameworks are a convenient, easy target 3. 4 main attack vectors are relevant: Credential Stuffing, App layer attacks, DDoS, Data Scraping 4. Existing security solutions have drawbacks: ⢠Deep inspection of modern API message formats ⢠Technical difficulties implementing âAnti-Automationâ ⢠Lack of granular visibility ⢠Weak API management
- 40. Q & A
Editor's Notes
- #16: Bit.ly/bigdatabreaches