Security News
APIs power the digital world-our phones, smartwatches, banking systems and shopping sites all rely on APIs to communicate. The seamless integrations that APIs allow for have driven organizations across industries to increasingly leverage them - some more quickly than others.
Google is downplaying reports of malware abusing an undocumented Google Chrome API to generate new authentication cookies when previously stolen ones have expired. Last week, cybersecurity firm CloudSEK revealed that these information-stealing malware operations are abusing a Google OAuth "MultiLogin" API endpoint to generate new, working authentication cookies when a victim's original stolen Google cookies expire.
As the technological landscape increasingly integrates AI, Cindric anticipates a profound impact on the evolution of APIs, emphasizing the growing importance of API security, authentication, and the challenges posed by zombie endpoints. APIs have been growing at a CAGR of 25% for the past few years, but that growth doubled in 2023, all thanks to AI. We predict that AI-based APIs will continue to drive API growth in 2024 as they go hand in hand.
In 2024, we anticipate several key trends and predictions that will shape the landscape of API security. The API security market is currently in its early days, but as API security climbs the business agenda, we expect to see significant innovation in this space.
Starting Dec. 13, developers can use Google AI Studio and Vertex AI to build applications with the Gemini Pro API, which allows access to Google's new generative AI model. Google's initial rollout of Gemini was limited to Google Bard and the Pixel 8 Pro, so Wednesday's general availability of Gemini for Google AI Studio and Vertex AI marks the first test of Gemini for enterprise developers.
Automated API security testing predominantly uses tools from two application security methodologies: static application security testing and dynamic application security testing. API security testing is increasingly being integrated into the API security offering, translating into much more efficient processes, such as automatically associating appropriate APIs with suitable test cases.
The API tokens of tech giants Meta, Microsoft, Google, VMware, and more have been found exposed on Hugging Face, opening them up to potential supply chain attacks. Researchers at Lasso Security found more than 1,500 exposed API tokens on the open source data science and machine learning platform - which allowed them to gain access to 723 organizations' accounts.
Cybersecurity researchers from the firm Hunters discovered a vulnerability in Google Workspace that could allow unwanted access to Workspace APIs.According to the Hunters team, the vulnerability is based on Google Workspace's role in managing user identities across Google Cloud services.
Of the 239 vulnerabilities, 33% were associated with authentication, authorization and access control - foundational pillars of API security, according to Wallarm. Open authentication, single-sign on and JSON Web Token, safeguards for API security, were compromised in reputable tech organizations such as Sentry and WordPress.
Publicly-accessible Docker Engine API instances are being targeted by threat actors as part of a campaign designed to co-opt the machines into a distributed denial-of-service botnet dubbed OracleIV. "Attackers are exploiting this misconfiguration to deliver a malicious Docker container, built from an image named 'oracleiv latest' and containing Python malware compiled as an ELF executable," Cado researchers Nate Bill and Matt Muir said. The malicious activity starts with attackers using an HTTP POST request to Docker's API to retrieve a malicious image from Docker Hub, which, in turn, runs a command to retrieve a shell script from a command-and-control server.