Wiki › Techniques, Tactics & Procedures (TTPs) › Initial Access › Exposed API Keys and Secrets

Exposed API Keys and Secrets

2 min read

Jump to:

Overview

Exposed API keys and secrets refer to the inadvertent disclosure of sensitive credentials used to authenticate and authorize access to applications, services, or infrastructure. This technique is leveraged by adversaries to gain unauthorized access or escalate privileges within a target environment, often serving as an entry point or persistence mechanism in the attack lifecycle.

Attack Objective

Obtain unauthorized access or control over systems and data
Supports multiple stages including Initial Access, Persistence, Privilege Escalation, and Lateral Movement
Facilitates attacker movement and access to additional resources by exploiting exposed credentials

How the Technique Works

Adversaries identify and extract API keys, tokens, passwords, or other secrets that have been exposed through code repositories, configuration files, logs, or cloud storage. These credentials are then used to authenticate to services or APIs, allowing attackers to perform actions with the permissions granted to the compromised keys without needing to exploit vulnerabilities or obtain user credentials directly.

Common Methods & Variations

Discovery of secrets in public or private code repositories, container images, or cloud storage buckets
Targeting on-premises systems, cloud environments, identity providers, or endpoint configurations
Use of living-off-the-land techniques by leveraging legitimate APIs and tools with stolen keys, or deployment of custom tooling to automate exploitation

Indicators of Compromise (IOCs)

Unusual API call patterns or access from unexpected IP addresses
Authentication logs showing use of compromised keys or tokens
Presence of secrets in source code commits, configuration files, or environment variables
Alerts from secret scanning tools or cloud security posture management solutions

Detection Strategies

Monitoring authentication and access logs for anomalous usage of API keys and tokens
Behavioral detection focusing on unusual access patterns or privilege escalations
Correlation of secret scanning alerts with network and endpoint telemetry to identify potential misuse

Mitigation & Prevention

Implement secret management solutions and avoid hardcoding credentials in code or configuration files
Enforce least privilege on API keys and regularly rotate and revoke unused or exposed secrets
Use multi-factor authentication and conditional access policies for sensitive systems and APIs

Response Considerations

Immediately revoke or rotate exposed keys and secrets to prevent further unauthorized access
Conduct thorough investigation to identify scope of exposure and potential lateral movement
Harden secret management practices and review access controls to prevent recurrence

Related Techniques

Credential Dumping as a follow-on technique to obtain additional secrets
Use of Valid Accounts for leveraging compromised credentials
Cloud Service Discovery and Abuse related to exploitation of cloud API keys

Mapping & References

MITRE ATT&CK: Initial Access (T1078), Persistence (T1505), Credential Access (T1003), Defense Evasion (T1078)
Public research on secret exposure incidents and best practices for secret management
Advisories from cloud providers and security organizations on API key leakage and mitigation

Tags: Cloud Security Command & Control Credential Access Defense Evasion Execution Exfiltration Initial Access lateral movement persistence privilege escalation Secret Management