Shadow APIs: Risks, exploits, and how to detect them

How attackers exploit shadow APIs, and how to find them before a breach

Application programming interfaces (APIs) are the Legos of the software environment. They act as easy-to-use connectors that handle communication between separate programs to retrieve data. But what happens if there’s an active API that you don’t remember owning? If APIs are Legos, then forgotten and unpatched APIs — shadow APIs — are Legos you’re about to step on.

Key takeaways

• Shadow APIs are APIs that exist outside the IT department's knowledge or control, so they are often undocumented, unpatched, and unmonitored.
• They typically bypass API gateways and may lack authentication, input validation, and rate limiting.
• AI is making shadow APIs more dangerous by making them easier to create and easier for attackers to exploit.
• Manual audits can't keep pace with API growth, so detection needs to include data flow monitoring and awareness training.
• Comparing API traffic in your logs against your documented APIs is a direct way to spot a shadow API.

What is a shadow API, and what are the risks?

A shadow API is an application programming interface that operates outside the knowledge or control of an organization's IT and security teams. Because shadow APIs are typically undocumented, unmonitored, and unpatched, they can expose sensitive data and give attackers an easy way in.

If shadow IT represents forgotten, unmanaged, or uncontrolled hardware and software, shadow APIs are the same idea. They’re APIs that exist outside the IT department's knowledge or control. Maybe they were created by a previous IT director who left the company without providing documentation. Maybe they were created or implemented by an employee outside of IT who never asked for permission. Either way, it’s more than likely that these shadow APIs aren’t being updated or maintained in a timely manner.

Regular APIs collect data from one application and deliver it to another. Shadow APIs do the same thing, but you don’t know where the data is going. In the worst-case scenario, you may find a shadow API that’s sending unencrypted information over the public internet. It would be trivial to intercept and exploit this data.

How do attackers exploit shadow APIs?

When implemented correctly, APIs are routed through an API gateway. This is a software interface that acts as a unified hub for information requests. This keeps services streamlined and makes it easy to see where data is traveling. Shadow APIs, almost by definition, avoid API gateways.

In addition, shadow APIs may not implement best practices. These may include:

• Authentication: Which would ensure that only authorized users and vendors are able to use an API
• Input validation: Which would prevent bad actors from using unsanitized input to inject and execute malicious code
• Rate limiting: Which would slow down large numbers of requests, preventing attackers from attempting credential stuffing, mass data exfiltration, or denial of service attacks

Because of these vulnerabilities, API data breaches now account for nearly one-third of all incidents. Recent high-profile targets include Panera Bread and Lovable. The latter allowed attackers to download information via a Broken Object Level Authorization (BOLA) vulnerability. In layman’s terms, this meant that an API failed to verify that authenticated users were authorized to access other material, allowing them to steal data from other users.

The fact that these large, well-funded organizations can be struck by API data breaches is a troubling sign for other industries.

Why are shadow APIs getting more dangerous?

Shadow APIs are becoming a bigger risk, and there are three reasons why:

Shadow APIs are getting easier to develop

Time was, only a software developer could create an API. Although this still posed a risk — developers often created APIs to test new features and forgot to delete them afterward — the risk was contained by the number of developers involved. With AI, suddenly everyone is a developer. People who have never been trained in software development are creating APIs without knowing how to test them for security. Meanwhile, the actual developers are creating APIs faster than ever, and they may not have time to test or document their processes.

Exploitation tools are proliferating

Just as AI has democratized development tools, it’s also given attackers ways to vastly amplify their capabilities. It’s one thing to find an insecure API. Knowing how to exploit it is another thing entirely. But AI is a cheat code. An attacker can sit back and ask a repurposed commercial LLM to reverse-engineer an insecure API without expending any extra effort.

Manual detection and testing can’t keep up with API generation

Right now, API traffic accounts for almost 60% of overall web traffic, with usage growing by around 60% year over year. Behind the scenes, that indicates a staggering rate of API creation. If you manually audit your software environment for shadow APIs and test for insecurities, you’re going to lag far behind the pace of development.

How can you detect shadow APIs?

The good news is that there are several ways to detect shadow APIs outside of a manual audit, including security awareness training and data flow monitoring.

1. Train employees and developers. Hold training sessions and sit-downs with developers to raise awareness of the harms of insecure shadow APIs.
2. Monitor data flows. All API traffic leaves fingerprints on the network, such as custom headers, specific strings, and unique payloads.
3. Match traffic to your API inventory. Compare the traffic you detect against your central API database (you have one, right?).
4. Investigate mismatches. If the API traffic in your logs doesn't match your documentation, you've found a shadow API.

Even though undocumented APIs can be like Legos you’re about to step on, good audit and awareness practices can help you find the missing pieces. And if you want to speed up the process, talk to Barracuda about our machine-learning-powered API discovery tools that can find unprotected endpoints using live traffic, dramatically reducing your attack surface.