1. 红孩笔记首页
  2. 安全

API Security Weekly: Issue 162

• 安全 • 阅读 3659

This week, we have details of compromised Google Cloud accounts being used to mine cryptocurrency (mainly with weak or no passwords on API connections), there’s an article on how GraphQL can be used as an API gateway (including security controls), a very comprehensive guide to all things relating to API security, and a new API security training course from AppSecEngineer.

Vulnerability: Compromised Google Cloud Accounts Used to Mine Cryptocurrency

The main story this week comes from HackerNews and describes how attackers are able to exploit improperly secured Google Cloud Platform (GCP) tenants. The impact on affected users included compromising their cloud resources, like uploading cryptocurrency mining software, and ransomware and phishing attacks.

Of greatest concern is that the accounts could be compromised due to a lack of basic hygiene on the cloud tenants. The most common issue as well as exploit — affecting 48% of the instances — was weak or no password on user accounts and API connections that allowed attackers easy access to the cloud instances. Other exploits included installing third-party software in the cloud instances and leaking credentials through GitHub repositories.

The key takeaway here is that whilst cloud platforms are a great business enabler, their complexity frequently leads to misconfiguration which results in potentially vulnerable deployments. Additionally, many skilled attackers will know what the common misconfigurations are and home in on them, allowing them to easily exploit them in the attacks on systems.

Article: GraphQL as an API Gateway

An interesting article this week by Tj Blogumas describes a novel approach to using GraphQL as an API gateway.

Blogumas describes a typical design problem encountered in the adoption of a microservices architecture: how to present a single fronted to consumers without exposing the complexity of the backing microservices mesh. Traditionally, this has been the domain of the API gateways, but Blogumas demonstrates how a GraphQL frontend can achieve the same effect.

Of interest here is how you can implement security controls at the GraphQL gateway level rather than in the backing microservice APIs. The key advantage to this approach is that key security controls are centralized in one place — implemented only once at the gateway level, rather than at in individual APIs. This reduces the burden on development teams and reduces the likelihood that such controls get accidentally omitted.

Blogumas provides several examples of the type of security controls that can be implemented, such as:

  • Depth limiting: Reduce the depth of allowed queries to reduce the impact of Denial of Service (DoS) based attacks.
  • Rate limiting: Reduce the rate at which requests can be made to specific API endpoints to mitigate the effect of DoS or brute force attacks.
  • Query cost limitations: Reduce excessively complex queries to mitigate DoS attacks.

An interesting take on API architecture that we will surely hear more about.

Guide: “Awesome API Security” Guide

We have featured some excellent API security guides in this newsletter (such as the one last week by Inon Shkedy), and this week it is the turn of the "Awesome API Security" guide by André Rainho.

This vastly comprehensive guide covers, for example, the following topics:

  • Tools
  • Mind mapping
  • Checklists and cheatsheets
  • Training, walkthroughs, and laboratories
  • Enumeration and scanning
  • Fuzzing and API keys
  • Firewalls
  • Presentations, videos, playlists, and podcasts
  • Design and architecture
  • Specifications

This is bound to prove an invaluable resource for anyone working in or around API security — thanks to André for this great resource!

Training: AppSecEngineer’s 2021 Guide to API Security

Finally, for this week, we have news of upcoming API security training courses by the AppSecEngineer team, featured in their review of API security in 2021.

The course includes a deep dive into both offensive and defensive techniques for API developers. On offense, it covers typical vulnerabilities specific to REST APIs and how malicious actors can exploit them. On defense, it focuses on defensive techniques in a hands-on laboratory environment that follows the OWASP API Security Top 10 as a content outline.

It’s always good to see new API security training and — based on previous AppSecEngineer courses — this should prove to be a great success.

You can subscribe to this newsletter at APIsecurity.io.

文章来源于互联网:API Security Weekly: Issue 162

发布者：小站，转转请注明出处：http://blog.gzcity.top/4280.html

赞 (1)
打赏 微信扫一扫 微信扫一扫 支付宝扫一扫 支付宝扫一扫
916
上一篇 2022年5月3日 18:16
下一篇 2022年5月3日 18:17

相关推荐

  • An Introduction to PCI Compliance

    There are plenty of reasons for enterprises that work with cardholder data to care about payment card industry (PCI) compliance. For starters, maintaining PCI compliance is an esse…

    安全 2022年5月3日
    1.7K230

  • Go Application Vulnerability Cheatsheet

    Securing applications is not the easiest thing to do. An application has many components: server-side logic, client-side logic, data storage, data transportation, API, and more. Wi…

    安全 2022年5月3日
    1.8K70
  • WebLogic中间件任意命令执行漏洞。 学习笔记

    WebLogic中间件任意命令执行漏洞。

    一、背景简介 Weblogic是一款商用中间件应用服务器产品，可以为应用程序提供运行访问环境。 二、漏洞详情 公开日期：2022-07-29漏洞编号：暂无危害等级：高危漏洞描述：由于没有过滤危险字符，导致攻击者可以对T3/IIOP接口发送恶意内容，执行任意命令。 三、影响版本 未知 四、处置情况 1.暴露在公网的WebLogic应配置对外禁用T3和IIOP，…

    2022年8月3日
    4.3K8950
  • log4j 0day漏洞情况分析及说明 学习笔记

    log4j 0day漏洞情况分析及说明

    一、背景简介 2022年7月30日起，各大威胁情报社区及安全圈内开始盛传log4j存在0day漏洞，由于log4j在去年12月爆出严重的jndi注入漏洞，可通过在特定点插入恶意的jndi payload达到执行任意代码进而控制主机的目的。 log4j2（一般简称log4j）是Apache基金会开发维护的开源java日志组件，在以Java开发的系统中大量被直接…

    2022年8月3日
    78100
  • Apache Log4J2 远程代码执行漏洞处置手册 学习笔记

    Apache Log4J2 远程代码执行漏洞处置手册

    1、漏洞概述 Apache Log4j2是一个基于Java的日志记录工具。该日志框架被大量用于业务系统开发，用来记录日志信息。此次爆发的0day漏洞触发条件为只要外部用户输入的数据会被日志记录，即可造成远程代码执行。 漏洞细节 漏洞PoC 漏洞EXP 在野利用已公开 已公开 已公开 存在 参考链接：https://issues.apache.org/jira…

    2022年8月3日
    2.2K1400

回复 Jamescex

您的邮箱地址不会被公开。 必填项已用 * 标注

评论列表（916条）