Select your localized edition:

Close ×

More Ways to Connect

Discover one of our 28 local entrepreneurial communities »

Be the first to know as we launch in new countries and markets around the globe.

Interested in bringing MIT Technology Review to your local market?

MIT Technology ReviewMIT Technology Review - logo

 

Unsupported browser: Your browser does not meet modern web standards. See how it scores »

The rapid growth of Web applications has been fueled in part by application programming interfaces (APIs)–software specifications that allow sites and services to connect and interact with one another. But at the DEFCON hacking conference in Las Vegas last weekend, researchers revealed ways to exploit APIs to attack different sites and services.

APIs have been behind the meteoric rise of many key social sites. The social-networking site Facebook, for example, won huge gains in popularity and attention after opening its site to applications written by outside developers using its API.

The API of the microblogging media darling, Twitter, is also credited with partly driving its popularity. John Musser, the founder of Programmable Web, a website for users of mashups and APIs, says that the traffic that comes into Twitter through APIs–for example, from desktop clients–is four to eight times greater than the traffic that comes through its website. “The API has been crucial to the success of that startup,” he says.

But researchers Nathan Hamiel of Hexagon Security Group and Shawn Moyer of Agura Digital Security say that APIs could also be exploited by hackers. They note that several APIs are often stacked on top of each other. For example, an API might be used by the developers of other websites who, in turn, publish APIs of their own. “There could be security problems at the different layers when this sort of stacking happens,” Hamiel says.

Hamiel also notes that APIs can open sites to new kinds of threat. For example, he points to APIs for building applications that work across multiple websites. These tools may allow developers to pull in content from third-party websites, but Hamiel says that this also opens up possibilities for attacks.

During his presentation Hamiel showed that an attacker might be able to use an API in unintended ways to gain access to parts of a website that shouldn’t be visible to the public. “Whenever you add functionality, you increase your attack surface,” Hamiel says, noting that what makes an API powerful is often the same as what makes it risky.

0 comments about this story. Start the discussion »

Credit: Technology Review

Tagged: Web, web applications, computer security, DEFCON, mashups, API

Reprints and Permissions | Send feedback to the editor

From the Archives

Close

Introducing MIT Technology Review Insider.

Already a Magazine subscriber?

You're automatically an Insider. It's easy to activate or upgrade your account.

Activate Your Account

Become an Insider

It's the new way to subscribe. Get even more of the tech news, research, and discoveries you crave.

Sign Up

Learn More

Find out why MIT Technology Review Insider is for you and explore your options.

Show Me