Topic 5.1 · Unit 5: Securing Applications and Data · 35 minute session
5.1 Application and Data Vulnerabilities and Attacks
Adversaries go after data by reading unencrypted files, abusing administrative privileges and exploiting weak access control settings. Applications that fail to validate user input are open to injection-type attacks such as structured query language (SQL) injection and cross site scripting (XSS); a buffer overflow feeds in more input than memory can hold. Directory traversal edits uniform resource locators (URLs) and GET requests to reach files outside a web application's folder. Data risks are rated high, moderate or low by how sensitive the data are and how likely the exploit is.
Big idea Every input box is a door. If the application does not check what comes through it, the adversary's text becomes the application's instructions.
Course and exam description (CED) codes covered: 5.1.A.15.1.A.25.1.A.35.1.B.15.1.B.25.1.B.35.1.B.45.1.B.55.1.B.65.1.B.75.1.B.85.1.B.95.1.B.105.1.C.15.1.C.25.1.C.35.1.C.4
Last reviewed against the CED:
By the end of this session you can
- 5.1.A Explain how adversaries can exploit application and file vulnerabilities to cause loss, damage, disruption, or destruction.
- 5.1.B Explain how application attacks exploit vulnerabilities.
- 5.1.C Assess and document risks from application and data vulnerabilities.
1. How adversaries reach files (5.1.A)
| Weakness | What the adversary can do |
|---|---|
| Unencrypted files 5.1.A.1 | Read any of them, once they have access to the device or drive that stores them |
| Regular users with administrative privileges 5.1.A.2 | Administrative users control system settings and can typically access any file or application. Compromise one of these users and the adversary has elevated privileges on the system |
| Weak access control settings 5.1.A.3 | Many users can view, and sometimes edit, files. Adversaries use this to steal or destroy files or disrupt an application |
2. How application attacks exploit vulnerabilities (5.1.B)
An application is a program that runs instructions on a computer: it is executable data. Some run locally on the user’s computer; others, like web applications, run on a server and are reached over a network 5.1.B.1.
Many applications take user input in open-ended fields where users type letters, numbers and punctuation. Developers should check that input matches what is expected, for example only digits when the field asks for a number of items, and reject anything outside the expected parameters. Checking input before processing it is data validation. Applications that fail to validate input are vulnerable to injection-type attacks, where adversaries insert unexpected character strings to change how the program behaves 5.1.B.2.
SQL injection
Structured query language (SQL) requests information from databases and changes databases and their entries. An application that builds a database query from unvalidated or unsanitized user input is vulnerable 5.1.B.3. An SQL-injection attack places SQL commands and control characters into an input field. It can breach confidentiality (the application returns more information than it should) or integrity (data in the database are modified or deleted) 5.1.B.4.
input typed: x' OR 1=1 -- query built: SELECT * FROM members WHERE card = 'x' OR 1=1 --' # the quote closes the text early, OR 1=1 is always true, # and -- turns the rest into a comment: every member comes back
Cross site scripting (XSS)
Websites are written in hypertext markup language (HTML), and many use JavaScript for dynamic content. JavaScript runs in the visitor’s browser, so it can reach sensitive data stored there, such as usernames, passwords and cryptographic keys 5.1.B.5. A cross site scripting (XSS) attack injects malicious code into a website that the user’s browser then runs 5.1.B.6:
| Type | Where the code hides | Who is affected |
|---|---|---|
| Type I, reflected XSS | In a link the user clicks | The user who clicks it |
| Type II, stored XSS | Posted onto the site in a comment field, forum post or visitor log | Every user who visits the page |
Buffer overflow
When an application takes input, the input is written to a buffer: a set section of memory with a fixed size. Input larger than the buffer can overflow into the next memory locations and overwrite other parts of memory 5.1.B.7. A buffer overflow attack feeds in more data than was allotted. It can crash the system, or make it run code outside the program’s security policy, letting the adversary access, modify or delete files 5.1.B.8.
Directory traversal
The files that run a web application sit in directories on a server. Browsers request them with hypertext transfer protocol (HTTP) GET requests, and each GET request reaches a file somewhere in the server’s file system 5.1.B.9. In a directory traversal attack, adversaries edit URLs and GET requests to try to reach sensitive data, such as usernames and passwords, elsewhere on the server 5.1.B.10. Each ../ moves up one directory:
GET /recipes/photos/soup.jpg # expected GET /recipes/photos/../../../backups/users.csv # climbs 3 folders up, then into backups
3. Assessing and documenting data risks (5.1.C)
Data security risks hit confidentiality when unauthorized people can access sensitive data, integrity when data can be manipulated or altered, and availability when data can be destroyed or encrypted so others cannot reach them 5.1.C.1.
| Risk level | Typical pattern | Example (original) |
|---|---|---|
| High 5.1.C.2 | Highly sensitive data, often governed by laws or regulations, exposed to a highly likely exploit | A clinic’s patient records on a public file share with no password |
| Moderate 5.1.C.3 | Sensitive data without strong enough encryption or strict enough access controls | Student home addresses in a file encrypted with a short key |
| Low 5.1.C.4 | Less sensitive information with shorter keys or loose access controls | A club’s meeting minutes on a shared drive that every member can edit |
Now audit a file server the way an analyst would.
Lock it in: memory hooks
One picture per idea. If you remember the hook, you can rebuild the details.
- Four application attacksInject the query (SQL), inject the page (XSS), overfill the memory (buffer overflow), climb the folders (traversal).
- Reflected vs stored XSSReflected rides a link you click; stored waits in a comment for everyone.
- Risk levelsHigh: very sensitive and very likely. Moderate: sensitive but weakly protected. Low: less sensitive, loosely protected.
Common misconceptions
"Only administrators can do damage, so standard users do not need limits."
Not quite. Weak access control settings let many users view or even edit files. An adversary who compromises any of those accounts inherits that access.
"XSS attacks the web server."
Not quite. XSS injects code that the user's browser runs. It targets the visitors, for example by reading usernames, passwords or keys stored in the browser.
"A buffer overflow only crashes the program."
Not quite. It can crash a system, but it can also let code run outside the program's security policy, so the adversary can access, modify or delete files.
Exam traps
- Data validation checks that input matches what is expected, such as a number for a quantity, and rejects anything else. Failing to validate is the vulnerability; injection is the attack.
- Type I XSS is reflected (in a link the user clicks). Type II XSS is stored (posted onto the site, so it hits every visitor).
- In a URL, .. means one directory up. A run of ../ is the sign of directory traversal.
- SQL injection can breach confidentiality (returns more data than it should) or integrity (modifies or deletes data).
By the numbers
Say each list out loud, then tap to check.
3 ways files are exposed Say them, then tap
- unencrypted files
- regular users with administrative privileges
- weak access control settings
4 application attacks Say them, then tap
2 types of XSS Say them, then tap
- Type I reflected
- Type II stored
3 risk levels for data Say them, then tap
- high
- moderate
- low
In 30 seconds
- Unencrypted files can be read by anyone with access to the device or drive; admin rights on a compromised user account give elevated privileges; weak access controls let adversaries steal or destroy files.
- Applications that do not validate input are vulnerable to injection-type attacks.
- SQL injection puts SQL commands and control characters in an input field; XSS injects code a browser runs; a buffer overflow overfills fixed-size memory; directory traversal edits URLs and GET requests to reach other files.
- Data risks can hit confidentiality, integrity or availability, and are rated high, moderate or low.
Cover this list, say the points out loud, then take the checkpoint without scrolling back up.
Checkpoint · 9 questions
Checkpoint: Application and Data Vulnerabilities and Attacks
Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.
-
An adversary steals a receptionist's password through a phishing email, logs in to her laptop, disables the anti-malware software and installs new programs. Every employee at the office is in the Administrators group.
-
A gym's member portal asks for a membership number. A user types the following into the field, and the page then lists the records of every member.
Membership number field Input typed 0' OR 1=1 -- -
An adversary posts a product review on a shopping site. The review contains JavaScript code. Every shopper who opens the product page afterward has their session information sent to the adversary.
-
A message sent to students contains a link to the school website with a script hidden in the address. Students who clicked it had passwords saved in their browsers sent to the adversary; students who visited the website normally were unaffected.
-
A printer's web interface stores the "device name" field in a 32-byte area of memory. An adversary submits a 2,000-character device name, and the printer starts running instructions that were in the extra characters.
-
A web server keeps its menu images in /site/menus/. Four GET requests arrive.
GET requests Request Path requested R1 /menus/lunch.png R2 /menus/dinner.png?size=large R3 /menus/../../../config/accounts.db R4 /search?dish=pasta -
An analyst reviews four findings at a pharmacy chain.
Data findings Finding Observation F1 Patient prescription histories are on a file share that any device on the guest Wi-Fi can open F2 Employee home addresses are in a spreadsheet encrypted with a short key F3 Store opening hours are in an unencrypted file that all staff can edit F4 Marketing photos are backed up to an encrypted drive in a locked office
Key terms: flip the cards
Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.
-
Applicationtap to flip
A program that runs instructions on a computer: executable data. Some run locally, others (web applications) run on a server reached over a network.
Example and CED codes -
Data validationtap to flip
Verifying that user input meets the expected criteria, such as digits for a quantity, before processing it, and rejecting anything outside the expected parameters.
Example and CED codes -
Injection-type attacktap to flip
An attack that inserts unexpected character strings into input fields to change a program's behavior.
Example and CED codes -
SQL injectiontap to flip
An attack that places structured query language (SQL) commands and control characters into an input field, so the application returns too much data or changes and deletes data.
Example and CED codes -
Cross site scripting (XSS)tap to flip
An attack that injects malicious code into a website so the user's browser runs it; Type I is reflected (in a link) and Type II is stored (posted on the site).
Example and CED codes -
Buffer overflowtap to flip
An attack that feeds more data into a fixed-size buffer in memory than was allotted, overwriting nearby memory to crash the system or run unauthorized code.
Example and CED codes -
Directory traversaltap to flip
An attack that edits uniform resource locators (URLs) and hypertext transfer protocol (HTTP) GET requests, usually with ../, to reach sensitive files outside a web application's folder.
Example and CED codes -
Escalate privilegestap to flip
To reach accounts with more permissions, the goal of the lateral movement phase.
Example and CED codes -
Confidentialitytap to flip
A security principle: only authorized people, systems or processes can access data. Without it: data theft or destruction.
Example and CED codes -
Integritytap to flip
A security principle: data are accurate and trustworthy. Without it: data manipulation.
Example and CED codes -
Availabilitytap to flip
A security principle: data and services are accessible to authorized people when needed. Without it: unexpected downtime.
Example and CED codes
Questions students ask
What is the difference between SQL injection and XSS?
SQL injection sends SQL commands through an input field to the application's database. XSS injects code, usually JavaScript, into a website so that visitors' browsers run it.
How does a directory traversal attack work?
A browser asks for files with HTTP GET requests. The adversary edits the URL or request with ../ sequences to climb out of the web folder and request sensitive files, such as password lists, elsewhere on the server.
Why do administrative privileges on everyday accounts matter?
Administrative users can change system settings and reach almost any file. If an adversary compromises a regular user who has admin rights, the adversary gets those elevated privileges too.