API Security Testing for a European Bank

Summary

A European universal bank was launching an open API platform to give clients access to web applications — including mobile banking, card-to-card transfers, and business apps. Since an API can be a loophole for attackers to reach sensitive client data and finances, the bank needed penetration testing to find what needed patching. As a returning partner, INNERLUXES ran two-stage (black-box and white-box) API security testing in two weeks per OWASP standards and delivered a detailed remediation report.

About the Client

The Client is a European universal bank that provides financial services online and through a network of physical branches across the country.

The Challenge

Recognizing the key role of technology in maintaining a competitive edge, the Client decided to launch an API. Through this platform, the bank's clients would access web applications, including mobile banking, card-to-card transfers, and a range of business applications.

Using the new API could present security problems for the bank, as the platform is a potential loophole for cybercriminals to access clients' sensitive data and finances. The Client needed to perform penetration testing of the new system to understand which API vulnerabilities required patching. Having previously had INNERLUXES conduct a series of penetration testing checks on the bank's network, the Client chose INNERLUXES again.

The Solution

The project had two stages: black-box and white-box penetration testing. INNERLUXES's security engineers performed both stages remotely, since it was assumed that attackers would access the API via the internet only.

Stage 1: Black-box penetration testing

Following the black-box model, our pentesters attempted to gain unauthorized access to the Client's API platform without any details on the applied security policies. This method ensures a pentester has the same entry points as an actual intruder.

The open API penetration testing was based on the OWASP Top 10 standard — an up-to-date list of the most critical web application vulnerability types and effective methods to eliminate them. Each vulnerability found among the OWASP Top 10 types was tagged with an appropriate risk level (low/medium/high).

INNERLUXES's penetration testers manually conducted 10 types of security vulnerability assessments — for SQL injections, flaws in authentication, access control, and session management, and sensitive data exposure. Special attention went to security misconfiguration and cross-site scripting (XSS) flaws, as the most common issues. Our testers aimed to detect:

• User session hijacking via XSS or cookie decoding.
• Redirection to other sites.
• Injection of malicious JavaScript code.
• User query forgery for authentication.
• Sensitive data transfer via an unprotected HTTP channel.

Stage 2: White-box penetration testing

To verify that no vulnerabilities were left unattended during manual testing, INNERLUXES's security engineers conducted a source-code review of the Client's API with IBM Application Security on Cloud, an automated application scanner.

The Results

• In a two-week project, INNERLUXES's security engineers conducted a comprehensive check of the Client's open API per OWASP standards.
• INNERLUXES provided a detailed report on how to improve the current API security.
• The recommended best practices in vulnerability patching will help prevent severe security breaches of the Client's API and, ultimately, reputational loss and client churn.

Technologies and Tools

Nessus, IBM AppScan, IBM Application Security on Cloud, Acunetix, Burp Suite Pro, Sqlmap.