Lessons to Learn in Light of Twitter’s API Breaches

In December of 2021, Twitter suffered from a vulnerability related to one of its APIs. In July of the following year, 5.4 million users had their data leaked, as a result of this vulnerability, and put on sale through the black market. Another hacker has recently put this data up for sale, proving that these API attacks are quite problematic not just for big social networks like Twitter, but all businesses.

But first, what is an API, and what are the attacks which target them?

Application Programming Interface

The API is what allows programs to communicate with each other in a standardized way. For example, if you wanted to send money to someone through a shared application, then it would utilize an API. A smart appliance controlled through an app would also make use of an API.

The process works as follows:

1. You send a command to an application on your mobile device.
2. The application connects to the Internet to share the data contained in the command.
3. A server receives the data, interprets it, and carries out the appropriate actions
4. Your mobile device receives the data back and presents it to you.

APIs are mostly standardized, and because of this, they can mostly be counted on to remain secure. The related devices are only communicating the necessary information.

The Twitter API Vulnerability Removed This Separation

There was an exploit in one of Twitter’s APIs which allowed hackers to identify the owners of Twitter accounts. It did this by submitting email addresses and phone numbers to the API. By the time the issue was resolved in January of 2022, millions of users had their information leaked.

API Attacks Should be Taken Seriously

Twitter is not the only notable example of an API attack. Considering how many businesses rely on API functionality, you can bet that many of them suffer from data breaches because of them. The reasoning for this is that APIs are built to trust the systems that connect to them, meaning that if a hacker can gain access to an API, they have free reign to access an organization’s data.

And, of course, after access to the data is granted, that data can be used to fuel social engineering attacks to cause further harm.

How You Can Prevent API Attacks

If you want to avoid API attacks, you need to teach your team about them, and avoid giving out access to sensitive accounts. In particular, you should take steps to educate them on phishing attacks and other methods of scamming that hackers will use to take advantage of them. Any measures you can use to protect passwords and accounts are also helpful, like two-factor authentication and password management tools.

We Want to Help

If you’re ready to protect your business from API attacks, be sure to contact BNMC at (978) 482-2020. Our technicians can walk you through your options and help you implement them.