Twitter data breach shows APIs are a goldmine for PII and social engineering 

A Twitter API vulnerability shipped in June 2021 (and later patched) has come again to hang-out the group. In December, one hacker claimed to have the private knowledge of 400 million customers on the market on the darkish net, and simply yesterday, attackers launched the account particulars and e-mail addresses of 235 million customers totally free. 

Info uncovered as a part of the breach embrace customers’ account names, handles, creation date, follower depend and e-mail addresses. When put collectively, menace actors can create social engineering campaigns to trick customers into handing over their private knowledge. 

Whereas the data uncovered was restricted to customers’ publicly accessible info, the high-volume of accounts uncovered in a single location gives menace actors with a goldmine of knowledge they will use to orchestrate extremely focused social engineering assaults. 

Twitter: A social engineering gold mine 

Social media giants supply cybercriminals a gold mine of knowledge they will use to conduct social engineering scams. 

With only a title, e-mail handle and contextual info taken from a person’s public profile, a hacker can conduct reconnaissance on a goal and develop purpose-built scams and phishing campaigns to trick them into handing over private info.

“This leak primarily doxxes the private e-mail addresses of high-profile customers (but in addition of normal customers), which can be utilized for spam harassment and even makes an attempt to hack these accounts,” mentioned Miklos Zoltan, Privateness Affairs safety researcher. “Excessive-profit customers could get inundated with spam and phishing makes an attempt on a mass scale.”

For that reason, Zoltan recommends that customers create totally different passwords for every website they use to scale back the danger of account takeover makes an attempt.

The hyperlink between social engineering and API hacks 

Insecure APIs present cybercriminals with a direct line to entry person’s personally identifiable info (PII), usernames and passwords, that are captured when a consumer makes a connection to a third-party service’s API. Thus, API assaults present attackers with a window to reap private knowledge for scams en masse. 

This occurred only a month in the past when a menace actor efficiently utilized to the FBI’s InfraGuard intelligence sharing service, and used an API vulnerability to gather the information of 80,000 executives throughout the personal sector and put it up on the market on the darkish net. 

Info collected through the incident included knowledge resembling usernames, e-mail addresses, Social Safety numbers and dates of start — all extremely precious info for growing social engineering scams and spear phishing assaults. 

Sadly, it seems that this pattern of API exploitation will solely worsen, with Gartner predicting that this 12 months, API abuse will grow to be probably the most frequent assault vector. 

Past APIs that ‘simply work’

Organizations too are more and more involved round API safety, with 94% of expertise decision-makers reporting they’re solely reasonably assured of their group’s capability to materially scale back API knowledge safety points. 

Any more, enterprises that leverage APIs should be rather more proactive about baking safety into their merchandise, whereas customers have to take further warning round doubtlessly malicious emails. 

“It is a widespread instance of how an unsecured API that builders design to ‘simply work’ can stay unsecured, as a result of in terms of safety, what’s out-of-sight is usually out-of-mind,” mentioned Jamie Boote, affiliate software program safety advisor at Synopsys Software program Integrity Group. “Any more, it’s most likely greatest to only delete any emails that seem like they’re from Twitter to keep away from phishing scams.” 

Defending APIs and PII 

One of many core challenges round addressing API breaches is the truth that trendy enterprises want to find and safe hundreds of APIs.  

“Defending organizations from API assaults requires constant, diligent oversight of vendor administration, and particularly guaranteeing that each API is match to be used,” mentioned Chris Bowen, CISO at ClearDATA. “It’s so much for organizations to handle, however the danger is simply too nice to not.”

There’s additionally a slim margin for error, as a single vulnerability can put person knowledge straight prone to exfiltration. 

“In healthcare, for instance, the place affected person knowledge is at stake, each API ought to handle a number of elements like id administration, entry administration, authentication, authorization, knowledge transport and alternate safety, and trusted connectivity,” mentioned Bowen. 

It’s additionally vital that safety groups not make the error of relying solely on easy authentication choices resembling usernames and passwords to guard their APIs. 

“In right this moment’s atmosphere, fundamental usernames and passwords are now not sufficient,” mentioned Will Au, senior director for DevOps, operations and website reliability at Jitterbit. “It’s now important to make use of requirements resembling two-factor authentication (2FA) and/or safe authentication with OAuth.”

Different steps like deploying a Internet Software Firewall (WAF), and monitoring API site visitors in real-time will help to detect malicious exercise and scale back the prospect of compromise.