Scan Finds Exposed APIs and Email Spoofing Risks at Digital Lending Firm
Summary
A CloudSEK scan found publicly accessible APIs that exposed internal information and misconfigured SPF records that could enable email spoofing at a digital lending firm. The article recommends securing APIs, correcting email settings, and scanning regularly.
Key points
- CloudSEK’s BeVigil API and DNS Scanner identified internal APIs accessible without authentication.
- The APIs exposed employee records, operational details, and information about internal processes, according to the article.
- Misconfigured SPF records could make email spoofing and phishing against staff or clients easier.
- Some exposed APIs could potentially be misused to alter workflows or disrupt services; the article does not report confirmed exploitation.
- Recommended steps include requiring authentication for sensitive APIs, reviewing SPF, DKIM, and DMARC settings, and scanning systems regularly.
Article Details
- Defense Focus
- Identify and remediate publicly accessible unauthenticated APIs and misconfigured email authentication at a digital lending firm.
- Detection Methods
- Use API and DNS scanning to identify exposed APIs and misconfigurations.
- Continuously scan systems for misconfigurations and vulnerabilities.
- Data Sources
- API endpoints
- DNS records
- SPF, DKIM, and DMARC records
- Platforms
- BeVigil
- Defensive Actions
- Require authentication for sensitive APIs and prevent unnecessary public internet access.
- Review and correct SPF, DKIM, and DMARC records to reduce email spoofing.
- Scan systems regularly for misconfigurations and vulnerabilities.