Cequence Security Releases Report Revealing Top 3 Attack Trends in API Security
Leading API security vendor reveals fraud, shopping bot sophistication and account takeovers skyrocketed in the last year
Sunnyvale, Calif. – March 15, 2022 – Cequence Security, the industry leader in API security, today released its “API Security Threat Report: Bots and Automated Attacks Explode,” revealing that both developers and attackers have made the shift to APIs. Of the 21.1 billion transactions analyzed by Cequence Security in the last half of 2021, 14 billion (70 percent) were API transactions.
After analyzing some of the most interesting bot attacks throughout 2021, it’s clear that attackers have come to love APIs just as much as developers.
“Name one department in your company that does not use APIs. APIs are absolutely critical to business operations across sectors from healthcare to retail to banking,” said Larry Link, President and CEO of Cequence Security. “The bottom line is that enterprises will remain at a high risk of losing valuable data, customer loyalty and revenue until they invest adequate resources into securing their APIs. Attackers aren’t slowing down any time soon, and it’s time businesses match that rate of innovation.”
Notable attacks included in Cequence’s 2021 observations can be categorized into three key trends.
Attack Trend One: Fraud Comes in Many Forms
Gift Card Fraud, Loan Fraud and Payment Fraud
In late July, Cequence saw retail customers get hit with a 2800% increase in ATOs averaging 700K attacks per day with the end goal of committing multiple forms of gift card fraud in the form of “scrape for resale” or “steal to then purchase” goods.
When investigating a loan application fraud attack, Cequence saw that attackers were using the sub accounts feature on public email domains such as Gmail to create 3,000 email addresses which were then used to submit multiple loan applications distributed across multiple IP addresses. The discovery uncovered roughly 45,000 fraudulent loan applications, which were canceled immediately by the Cequence API Security Platform without any human or manual intervention.
As for payment fraud, Cequence researchers uncovered threat actors targeting an API and making regularly spaced payment authorization calls from more than 20,000 phone numbers, all emanating from three zip codes and representing 5.1 percent of the overall payment traffic. The CQ Prime threat research team analyzed the circumstances and shut down the attack before payment fraud was successful.
Attack Trend Two: Shopping Bots Get More Sophisticated
Enter Bots-as-a-Service (BaaS)
Bots-as-a-service (BaaS) allows anyone to buy, rent and subscribe to a network of malicious bots and use it to acquire high-demand items. Cequence retail customers often perform short duration hype sales, which typically generate approximately 3M transactions over the typical product launch lasting a few hours. Bots drove the traffic to 36M (1200%) to 129M (4300%) above normal with up to 86 percent of the transactions being malicious.
Attack Trend Three: The Account Takeover Cat-and-Mouse Game
The CQ Prime Threat Research Team helped a retail customer fend off a series of attacks over a three-month period that typified the extent to which attackers will modify their efforts in order to achieve success. Attack patterns went from massive in nature, with malicious ATOs making up 80% of the login traffic to the polar opposite patter of low, slow and perfectly formed transactions.
Data source and methodology – Cequence is a leader in API Security and the “API Security Threat Report: Bots and Automated Attacks Explode” report data was collected and analyzed from F500 financial services, retail, and telecom organizations. The full report can be accessed here.
About Cequence Security
Organizations trust Cequence Security to protect their APIs and web applications with the most effective and adaptive defense against online fraud, business logic attacks, exploits and unintended data leakage; which enables them to remain resilient in today’s ever-changing business and threat landscape. Cequence is the only API Security Platform offering that unifies API discovery, inventory tracking, risk analysis and native mitigation with proven, real-time threat protection against ever evolving API attacks. Learn more at www.cequence.ai
Media Contact
Ashley Long
Merritt Group for Cequence Security
long@merrittgrp.com
###
