India Becomes Top Global Target for API Attacks

One clear observation, apart from the global presence of web applications and API attacks, is that the most used attack vector has now become local file inclusion (LFI). 

This was consistent for the top five countries across the globe from December 2021 to March 2022. Previous Akamai threat research reports indicated that Structured Query Language injection (SQLi) was formerly the most used attack vector. .

Understanding the LFI attack vector

LFI is a software attack technique in which the attacker tries to trick a web application into running or exposing files on a web server. It is considered by the Open Web Application Security Project as a dangerous attack as it can expose sensitive data and lead to other attacks such as cross site scripting (XSS), remote code execution, or distributed denial of service. 

For example, when a web page receives as input the path to a file with unsanitized content, the server would allow the content of the file to run as part of the web application code. 

This enables the attacker to remotely execute malicious code such as malware, which could be the first stage of a ransomware attack.

Another use case would be directory traversal, which would allow the attacker to expose sensitive or confidential information like users’ credentials. 

A simple example of a directory traversal attack is when an application displays or allows the user to download a file by changing a parameter in the web URL.

FROM:

https://vulnerable-site.com/?module=contact.php 

TO:

https://vulnerable-site.com/?file=/etc/password

A vulnerable server would subsequently allow the system call, switch to root, and expose the content of the passwd file. 

India: a top global attack target

Figure 2 depicts the number of web application and API attacks in India in millions from December 2021 to February 2022. Each graph line represents an attack vector, with the dark green line representing the total number of attacks inclusive of all attack vectors. 

We observed:

• Two major spikes, with February lasting the whole month indicating that attackers were renewing their focus in targeting web applications and APIs

• LFI was the preferred attack vector

This could explain the change of attack vectors to LFI as attackers have been trying to find the easiest way to expose sensitive data or to create a staging ground for ransomware attacks. 

We have seen major data breaches in India in which the command and control servers were actually an internal server used as a launching pad for lateral movement attacks such as ransomware.

Weak authentication and account takeover

Other key API vulnerabilities are weak authentication and account takeover. Unlike APIs, web browsers are traditionally able to issue challenges like captcha by rendering JavaScript as a first line of defense against credential stuffing attacks by malicious bots.

APIs are not able to render JavaScript and prevent credential stuffing–type attacks, making them vulnerable to using stolen credentials to gain unauthorized access to a server or endpoint.

Malicious bot requests

In the first half of 2022, we observed a steady increase of malicious bot attacks in India, hitting over 1 billion malicious bot requests in April 2022. Akamai research shows that an overwhelming number of bot requests are malicious and 10 times higher than benign requests; this would indicate that attackers are extensively using malicious bots to automate API attacks (Figure 5).