Cequence Security Releases Report Revealing Top 3 Attack Trends in API Security

Leading API security vendor reveals fraud, shopping bot sophistication and account takeovers skyrocketed in the last year

Cequence Security, the industry leader in API security, released its “API Security Threat Report: Bots and Automated Attacks Explode,” revealing that both developers and attackers have made the shift to APIs. Of the 21.1 billion transactions analyzed by Cequence Security in the last half of 2021, 14 billion (70 percent) were API transactions.

“API Security Threat Report: Bots and Automated Attacks Explode”

After analyzing some of the most interesting bot attacks throughout 2021, it’s clear that attackers have come to love APIs just as much as developers.

Download Our Top Whitepaper : Building Reliable and Secure Fintech Systems in 2022

“Name one department in your company that does not use APIs. APIs are absolutely critical to business operations across sectors from healthcare to retail to banking,” said Larry Link, President and CEO of Cequence Security. “The bottom line is that enterprises will remain at a high risk of losing valuable data, customer loyalty and revenue until they invest adequate resources into securing their APIs. Attackers aren’t slowing down any time soon, and it’s time businesses match that rate of innovation.”

Notable attacks included in Cequence’s 2021 observations can be categorized into three key trends.

Attack Trend One: Fraud Comes in Many Forms

Gift Card Fraud, Loan Fraud and Payment Fraud

In late July, Cequence saw retail customers get hit with a 2800% increase in ATOs averaging 700K attacks per day with the end goal of committing multiple forms of gift card fraud in the form of “scrape for resale” or “steal to then purchase” goods.

When investigating a loan application fraud attack, Cequence saw that attackers were using the sub accounts feature on public email domains such as Gmail to create 3,000 email addresses which were then used to submit multiple loan applications distributed across multiple IP addresses. The discovery uncovered roughly 45,000 fraudulent loan applications, which were canceled immediately by the Cequence API Security Platform without any human or manual intervention.

As for payment fraud, Cequence researchers uncovered threat actors targeting an API and making regularly spaced payment authorization calls from more than 20,000 phone numbers, all emanating from three zip codes and representing 5.1 percent of the overall payment traffic. The CQ Prime threat research team analyzed the circumstances and shut down the attack before payment fraud was successful.

Recommended AI News: ColdQuanta Expands Executive Team with Appointment of Photonics and Software Technologists

Attack Trend Two: Shopping Bots Get More Sophisticated

Enter Bots-as-a-Service (BaaS)

Bots-as-a-service (BaaS) allows anyone to buy, rent and subscribe to a network of malicious bots and use it to acquire high-demand items. Cequence retail customers often perform short duration hype sales, which typically generate approximately 3M transactions over the typical product launch lasting a few hours. Bots drove the traffic to 36M (1200%) to 129M (4300%) above normal with up to 86 percent of the transactions being malicious.

Attack Trend Three: The Account Takeover Cat-and-Mouse Game

The CQ Prime Threat Research Team helped a retail customer fend off a series of attacks over a three-month period that typified the extent to which attackers will modify their efforts in order to achieve success. Attack patterns went from massive in nature, with malicious ATOs making up 80% of the login traffic to the polar opposite patter of low, slow and perfectly formed transactions.

Data source and methodology – Cequence is a leader in API Security and the “API Security Threat Report: Bots and Automated Attacks Explode” report data was collected and analyzed from F500 financial services, retail, and telecom organizations. The full report can be accessed here.

Recommended AI News: Jaguar Land Rover Gives Second Life To I-PACE Batteries

[To share your insights with us, please write to sghosh@martechseries.com]