Menu
Financial services increasingly targeted for API-based cyber attacks

Financial services increasingly targeted for API-based cyber attacks

API-based attacks are sharply on the rise, as cyber criminals take aim at the financial services industry, according to a new report from Akamai.

Credit: Dreamstime

A report published by cloud services and CDN (content delivery network) platform Akamai said that the financial services industry is an increasingly popular target for a wide range of cyber attacks, with application andAPI attacks against the vertical more than tripling in the past year.

APIs are a core part of how financial services firms are changing their operations in the modern era, Akamai said, given the growing desire for more and more app-based services among the consumer base.

The pandemic merely accelerated a growing trend toward remote banking services, which led to a corresponding growth in the use of APIs.

With every application and every standardisation of how various app functions talk to one another, which creates APIs, the potential target surface for an attacker increases. However, only high-tech firms and e-commerce companies were more heavily targeted via API exploits than the financial services industry.

“Once attackers launch web applications attacks successfully, they could steal confidential data, and in more severe cases, gain initial access to a network and obtain more credentials that could allow them to move laterally,” the report said.

“Aside from the implications of a breach, stolen information could be peddled in the underground or used for other attacks. This is highly concerning given the troves of data, such as personal identifiable information and account details, held by the financial services vertical.”

Beyond attacking financial services firms themselves, the report said, cyber criminals have customer accounts in their sights as well. More than 80 per cent of attacks against companies in the industry target customers, instead of institutions, via phishing or direct attack.

Attackers have been quick to leverage zero-day vulnerabilities discovered in systems used by financial services companies, noted Akamai.

One example from this year is the remote code execution vulnerability found in Atlassian’s Confluence Server and Data Center products — less than a week after the flaw was publicly disclosed, Akamai recorded nearly 80,000 Confluence-based attacks per hour during one period in the evening of June 7.

The company said the speed with which Confluence and other flaws of its type can be exploited by bad actors underlines the need for businesses to remain up-to-date with patching.

While application and API attacks against financial services companies have risen most sharply, Akamai said that other techniques are also becoming more and more common, with botnet activity up 81 per cent year-on-year, and DDoS attacks up by 22 per cent.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags cyber security

Events

EDGE 2023

EDGE is the leading technology conference for business leaders in Australia and New Zealand, built on the foundations of collaboration, education and advancement.

WIICTA 2023

ARN has celebrated gender diversity and recognised female excellence across the Australian tech channel since first launching WIICTA in 2012, acknowledging the achievements of a talented group of female front runners who have become influential figures across the local industry.

ARN Innovation Awards 2023

Innovation Awards is the market-leading awards program for celebrating ecosystem innovation and excellence across the technology sector in Australia.

Show Comments