5 Real Business Logic Failures That Led to Major Breaches

Business logic flaws are considered to be the most dangerous cluster of API vulnerabilities - and for good reason.

While some vulnerabilities are relatively easy to spot with scanners and penetration tests, business flaws are typically hard to detect as they occur within the bounds of your system's legitimate functionalities.

A rapidly growing list of organizations falling victim to major cybersecurity incidents resulting from business logic flaws serves as a cautionary warning for anyone overlooking thorough API security testing processes.

Business Logic Vulnerabilities 101

A business logic vulnerability refers to a flaw in the design of an API that can be exploited to achieve a malicious goal.

These flaws allow attackers to gain unauthorized access to sensitive data without turning to malware or exploits by using the API as it was designed in ways unintended by developers.

Because of this, business logic flaws can go undetected for years without triggering any alarms, making them a favorite target for bad actors.

That's why companies must have a process for identifying and fixing business logic vulnerabilities before they are exposed and exploited.

Read More: Why Business Logic Flaws Are Your #1 API Security Risk

These 5 Major Data Breaches Were Caused by Business Logic Flaws

Companies that don't take data security seriously often find themselves in trouble.

A data breach may result in a tsunami of lawsuits, massive financial losses, and permanent damage to an organization's reputation.

In fact, nearly a quarter of Americans stop doing business with companies that have experienced a data breach.

To help you avoid becoming a statistic, below we'll break down five real-world data breaches caused by business logic flaws and provide actionable tips on protecting yourself against them.

1. USPS Data Breach: 60 Million User Records Exposed

In 2018, the United States Postal Service (USPS) became a data breach victim when a cyberattacker opened the system to allow anyone with an active account at usps.com to view - or even view modify - account details of other users.

What Information Was Lost or Exposed?

Approximately 60 million records of users were exposed as a result of this major data breach.

The incident led to the unauthorized access of real-time delivery data, exposing all sensitive personal information on the affected accounts, including email addresses, user IDs, usernames, phone numbers, and street addresses.

How Did This Breach Happen?

The USPS data breach happened due to broken access controls in their informed delivery API.

This business logic flaw allowed attackers - or any authorized user for that matter - to gain access to other people’s sensitive data without any exploits by abusing the flaws in the legitimate authentication mechanisms.

How to Combat This Business Logic Flaw

Companies can take several steps to protect their APIs from this business logic vulnerability - some of the best examples include:

• Authenticate all API requests to ensure that user A can’t access user B’s information.
• Adopting the zero-trust security model to monitor both unauthorized and authorized users.
• Eliminating Basic Authentication (the standard combination of a username and password) and implement OAuth, JWT, or OpenID instead.
• Avoiding auto-increment IDs to drastically reduce the severity of a data breach should one occur.
• Considering the use of short-lived access tokens.

2. Citi Data Breach: Over 350,000 Customer Records Stolen

Since financial institutions contain large amounts of highly sensitive data that can be sold on the dark web, they have traditionally been a prime target for cybercriminals.

In 2011, Citi announced the security of its online banking platform was compromised, leaking personally identifiable information.

What Information Was Lost or Exposed?

A seemingly minor vulnerability allowed attackers to gain unauthorized access to 350,000 customer records of North American cardholders.

The breach exposed the names, account numbers, and contact information of the customers.

While sensitive financial data was not leaked, the company suffered major reputational losses.

How Did This Breach Happen?

The data breach occurred due to a parameter tampering attack targeting their business logic layer.

An attack using this method involves manipulating certain parameters exchanged between the client and server.

In this type of attack, web elements like cookies, URL strings, and hidden form fields can hijack a request to the database and gain unauthorized access to sensitive data or elevate their user privileges.

Read More: How Cybercriminals Acquired 350K Citi Customer Records (In-depth Analysis)

How to Combat This Business Logic Flaw

Several methods exist to prevent parameter tampering attacks on web applications and APIs:

• Ensure that the application or API validates and sanitizes all input parameters before they are used. Many techniques can be used to accomplish this, including regular expression matching, whitelist validation, and blacklist validation.
• Enforce cookie encryption to prevent parameter tampering.
• Do not include parameters in URL query strings.

3. HealthEngine Data Breach: 59,000+ Containing Personally Identifiable Information Leaked

Black market sales of medical records are on the rise since they contain all of an individual's personal information. Fraudulent transactions and blackmail can easily be carried out using these data sets.

Over the last three years, 93% of healthcare organizations experienced a data breach - including HealthEngine, a marketplace and review platform for healthcare services.

What Information Was Lost or Exposed?

The data breach exposed over 59,000 records of patients’ personally identifiable information.

The incident brought the attention of the Australian Competition and Consumer Commission that went in to audit the company and fined HealthEngine $2.9 million for violating privacy and consumer laws.

How Did This Breach Happen?

The attacker didn’t need to use any sophisticated hacking techniques to harvest the records as the data breach was caused due to a pretty common vulnerability known as excessive data exposure.

Excessive data exposure vulnerabilities occur whenever an API returns more information than a user needs to perform a given task or action.

In HealthEngine’s case, the backend of the system sent healthcare practice review data along with all the personally identifiable information of the patient who had submitted the feedback.

Since the client was responsible for data filtering, it was easy for anyone to analyze network calls to collect the records.

Read More: How Cybercriminals Acquired Patients' Personally Identifiable Information from HealthEngine (In-depth Analysis)

How to Combat This Business Logic Flaw

Excessive data exposure is a common yet overlooked cybersecurity issue that plagues web applications and APIs.

Consider the following measures to reduce the attack surface:

• Avoid returning entire database objects in API responses.
• Never rely on the client for data filtering - simply hiding certain fields doesn’t prevent cybercriminals from accessing them.
• Minimize the amount of data in your API responses to the bare minimum needed to execute a certain task.
• Make sure your error pages don't contain any information that can help bad actors identify your tech stack.

4. Symantec Data Breach: 23,000 SSL Certificates Revoked

In 2019, Symantec, one of the largest cybersecurity companies in the US, found itself on the receiving end of a data breach, which resulted in severe reputational and legal repercussions.

What Information Was Lost or Exposed?

After thousands of private keys were exposed, DigiCert, a leading provider of digital certificates, revoked 23,000 Symantec SSL certificates.

How Did This Breach Happen?

The incident was caused by a broken access control vulnerability in the business logic. The API failed to properly validate whether a given user was allowed to access sensitive data.

The compromised records allowed the attackers to perform Man-in-the-middle attacks.

Read More: How a Common API Flaw Gave Attackers Access to Symantec's Customer Certificates (In-depth Analysis)

How to Combat This Business Logic Flaw

This business logic flaw can be averted by implementing the following measures:

• Analyze all possible ways for authorized and unauthorized users to authenticate to your APIs
• Implement rate-limiting to prevent automated attacks
• Enforce multi-factor authentication

5. Venmo Data Breach: Over 200 Million Transactions Harvested

In 2019, the money transfer site Venmo (owned by PayPal) became a victim of one of the largest data breaches in recent years.

What Information Was Lost or Exposed?

Approximately 200 million transactions were exposed along with massive amounts of sensitive data associated with them as a result of the data breach.

As a result, it was possible to analyze the entire transaction history of the compromised users, including the recipients, the amount of money sent, and even the purpose of those transactions.

How Did This Breach Happen?

The attacker scraped millions of Venmo payment records through their unsecured API that was leaking data.

The developer API was open to unauthenticated requests, making it possible for anyone to harvest highly sensitive data.

This business logic flaw is related to security misconfiguration, a cluster of API threats that ranks #7 on the OWASP API Security Top 10 list.

This vulnerability occurs when an API is left unsecured or poorly configured, leaving loopholes for attackers to take advantage of.

How to Combat This Business Logic Flaw

Consider implementing the following security measures to protect yourself against this cluster of vulnerabilities:

• Limit administrative access across all of your APIs.
• Enforce authorization and authentications mechanisms for all of your APIs - even for private or staging assets.
• Eliminate insecure default configurations.

The Only Automated API Security Testing Tool that Can Tackle Business Logic Flaws

Business logic flaws are almost impossible to spot using vulnerability scanners and penetration testing since each API is built in a unique way.

Popular API testing tools can only give you a surface-level view of the API while leaving critical issues unaddressed.

That’s where APIsec comes into play.

APIsec is the only automated API security testing solution that leverages the power of AI to deeply analyze your APIs, generate hundreds of custom-tailored attack scenarios, and execute them within minutes - not hours or days.

This approach allows APIsec to successfully identify business logic flaws for a fraction of the cost of manual pen-testing.

Sounds too good to be true? Get in touch with our team today to schedule a free demo.