Threat actors might send fake emails using disclosed API keys. Various Android applications on the Google Play Store have been identified as leaking Application Programming Interface keys. This is putting users at risk of identity theft and other security risks.

The cyber security website experts discovered the flaw after analyzing 600 applications on the Google Play Store. They found this using BeVigil – a security search engine.

Overall, the online security website team discovered that half (50%) of the top three transaction and email marketing service providers were leaking API credentials. This was placing consumers at risk of fraud or scams.

So, what is API?

An application programming interface (API) is code that enables two software applications to interact. An API outlines how a developer should request services from an operating system (OS) or other application. It also discloses data inside different contexts and through many channels.

Also, an application programming interface may communicate any type of data. APIs are implemented via function calls made of verbs and nouns. Furthermore, the requisite syntax is given in the documentation of the application being called.

Leaked API apps

CloudSEK – a security service website discovered that the applications were exposing MailChimp, SendGrid, and Mailgun APIs. It was allowing possible threat actors to send emails, remove API keys, and even manipulate multi-factor authentication (MFA). The company has subsequently alerted the app’s makers of their discovery.

Furthermore, the mobile apps were downloaded by 54 million individuals in all and are now in jeopardy. The majority of victims are in the United States, with significant numbers in the United Kingdom, Spain, Russia, and India.

Level of Data breach

MailChimp is likely the largest of the three email marketing tools. Releasing MailChimp API credentials allows threat actors to monitor email conversations, exfiltrate customer data, steal email lists, launch their email campaigns, and alter promotional codes.

Moreover, hackers might also activate third-party applications linked to a MailChimp account. In total, the researchers detected 319 API keys, with more than a quarter (28%) being legitimate. The Twelve keys were added and allowed for the email reading.

Furthermore, leaking MailGun API keys risk email security. This has allowed threat actors not only to send and read emails, but also to get SMTP credentials, IP addresses, and different statistics. They would also be able to exfiltrate client mailing lists.

SendGrid is a communication platform. It assists businesses in sending transactional and marketing emails using a cloud-based email delivery network. Hackers could leverage an API leak to send emails, generate API keys, and manage IP addresses needed to access accounts.

API security tips

APIs are used in contemporary software architecture to incorporate new application components into the current architecture. As a result, its security has become critical.

Software developers should avoid integrating API keys in their apps. In addition, they should employ safe coding and deployment techniques such as standardizing review protocols, rotating keys, hiding keys, and using a vault.

Here are some other security tips

• Implement authentication.
• Implement authorization.
• Validate all requests.
• Enforce encryption of every request and response.
• Only add relevant information in answers.
• Limit API requests and set quotas.
• Logical activity log book.
• Conduct security testing.

For secure API integration services visit IT Company.