Darknet Discussions Highlight Risks to API Security
Summary
DarkOwl describes darknet discussions and sales involving API tokens, keys, and exploitation tools, and relates them to incidents involving USPS, GitHub, Toyota, and FTX users.
Key points
- DarkOwl says API keys, tokens, and session credentials are discussed and offered for sale in darknet forums, Telegram groups, and paste sites such as pastebin[.]com.
- The article describes tools used to test API keys and a TikTok token generator advertised for checking usernames.
- A USPS API endpoint exposed information on more than 60 million U.S. residents, according to the article.
- Toyota reported that more than 2,900 records were exposed after an API access key was left publicly available on GitHub.
- In the FTX and 3Commas incident, API keys obtained through phishing or possibly information stealers were used for unauthorized transactions, the article says.
- DarkOwl argues that organizations’ growing reliance on APIs makes visibility into potentially exposed credentials important.
Article Details
- Topic
- Darknet discussions and trade involving API credentials, tokens, exploitation, and security incidents
Products
3CommasFTX users lose millions to 3Commas API exploitGitHub APIMore recently, in April 2022, Github admitted that attackers targeted private repositories using the Github API using stolen OAuth tokens.T-ConnectRecently, Toyota was notified of a breach that happened as the result of an API access key for T-Connect, the official Toyota connectivity app, being left publicly available on GitHub.USPS Informed Visibility APIFor example, in 2018, a vulnerable USPS Informed Visibility API endpoint leaked over 60 Million US residents information.
Tools
GobusterDarkOwl has also increasingly observed API penetration testing utilities – like GoBuster or Wfuzz – discussed in detail by non-english speaking darknet users.WfuzzDarkOwl has also increasingly observed API penetration testing utilities – like GoBuster or Wfuzz – discussed in detail by non-english speaking darknet users.