Description
Client: Unifonic
Category: Product Security
Date: 28 June 2023
Unifonic provides companies in the Middle East with seamless, multilingual, enterprise-grade communications at reasonable prices. The business has assisted various organizations in developing efficient customer communication since its founding in 2006. Up until this point, it has served more than 160 million recipients and more than 5000 commercial accounts.
Before They Met Us
- A multiple dashboard is used by Unifonic to manage all the services it offers to customers. The same entity is in charge of managing how its products and applications are used by its user base.
- The client was facing numerous issues with the API it was using. These issues initially seemed to be minor. But the client was fearful of major cyber incidents taking the prevalence of online threats into account.
- An insecure API was a constant threat to Unifonic’s operational continuity.
Our Objectives for the Project
- The purpose was to gather security weaknesses in Unifonic's API.
- A complete security audit to find what's lacking in the client's API security.
- Identifying the impacts of present vulnerabilities on mission-critical applications used by the client for day-to-day business operations.
Methodologies Used
- API Security Assessment to identify all the vulnerabilities and security weaknesses in the API.
- Credentialed Patch Audit.
- Thorough Penetration Testing to determine the impact of the vulnerabilities when exploited. • Simulated Privilege Escalation to check the resilience of current security policies.
- Simulated Privilege Escalation to check the resilience of current security policies.
Tools Used
OWASP ZAP: active and passive scanning, fuzzing, and vulnerability detection
Burp Suite: for intercepting requests, manipulating parameters, and scanning for vulnerabilities.
Postman: to identify security weaknesses and validate the behavior of APIs.
Tested API was not secure. It was not aligned with the best security practices.
We highlighted multiple security weaknesses in the said API that might result in catastrophic failures if attacked.
We delivered a thorough report to the client featuring all the exploited vulnerabilities, their impacts, and how to mitigate them.
However, we suggested that analyzing the Client’s API security posture is just one assessment. They should use other elements as well to get a definitive measurement of their security policies.
We recommended a complete review of internal security controls, procedures, or internal red teaming.
