1

High

The application must be navigable in a manner that associates elements (subsections) of the application with ACLs.

The various resources, or individual URLs, must be somehow discoverable by the attacker

The deployer must have forgotten to associate an ACL or has associated an inappropriately permissive ACL with a particular navigable resource.

Very High

• Analysis
• Brute Force

Low: In order to discover unrestricted resources, the attacker does not need special tools or skills. He only has to observe the resources or access mechanisms invoked as each action is performed and then try and access those access mechanisms directly.

No special resources are required for the exploit of this pattern.

In the case of web applications, use of a spider or other crawling software can allow an attacker to search for accessible pages not beholden to a security constraint.

More generally, noting the target resource accessed upon performing specific actions drives an understanding of the resources accessible from the current context.

In a J2EE setting, deployers can associate a role that is impossible for the authenticator to grant users, such as "NoAccess", with all Servlets to which access is guarded by a limited number of servlets visible to, and accessible by, the user.

Having done so, any direct access to those protected Servlets will be prohibited by the web container.

In a more general setting, the deployer must mark every resource besides the ones supposed to be exposed to the user as accessible by a role impossible for the user to assume. The default security setting must be to deny access and then grant access only to those resources intended by business logic.

• Privilege Escalation

The context of this pattern's applicability is most likely a web-based application, subject to an authorization framework.

All resources must be constrained to be inaccessible by default followed by selectively allowing access to resources as dictated by application and business logic

In addition to a central controller, every resource must also restrict, wherever possible, incoming accesses as dictated by the relevant ACL.

• Failing Securely
• Least Privilege
• Reluctance To Trust
• Complete Mediation

• Use Authorization Mechanisms Correctly
• Design Configuration Subsystems Correctly and Distribute Safe Default Configurations

Penetration

2

Medium

The system has a lockout mechanism.

An attacker must be able to reproduce behavior that would result in an account being locked.

High

• API Abuse
• Flooding
• Brute Force

Low

Computer with access to the login portion of the target system

Implement intelligent password throttling mechanisms such as those which take IP address into account, in addition to the login name.

When implementing security features, consider how they can be misused and made to turn on themselves.

• Denial of Service

96

Medium

An application requires access to external libraries.

An attacker has the priviliges to block application access to external libraries.

Medium

• API Abuse
• Modification of Resources

Low

Ensure that application handles situations where access to APIs in external libraries is not available securely. If the application cannot continue its execution safely it should fail in a consistent and secure fashion.

• Denial of Service
• Information Leakage
• Privilege Escalation

• Failing Securely

Exploitation

12

High

Information and client-sensitive (and client-specific) data must be present through a distribution channel available to all users.

Distribution means must code (through channel, message identifiers, or convention) message destination in a manner visible within the distribution means itself (such as a control channel) or in the messages themselves.

Very High

Low: All the attacker needs to discover is the format of the messages on the channel/distribution means and the particular identifier used within the messages.

The Attacker needs the ability to control source code or application configuration responsible for selecting which message/channel id is absorbed from the public distribution means.

Assisted protocol analysis: because the protocol under attack is a public channel, or one in which the attacker likely has authorized access to, they need simply to decode the aspect of channel or message interpretation that codes for message identifiers.
Probing is as simple as changing this value and watching its effect.

Associate some ACL (in the form of a token) with an authenticated user which they provide middleware. The middleware uses this token as part of its channel/message selection for that client, or part of a discerning authorization decision for privileged channels/messages.
The purpose is to architect the system in a way that associates proper authentication/authorization with each channel/message.

Rearchitect system input/output channels as appropriate to distribute self-protecting data. That is, encrypt (or otherwise protect) channels/messages so that only authorized readers can see them.

• Information Leakage
• Privilege Escalation

This pattern applies in circumstances in which publically accessible distribution means code (through channel, message identifiers, or convention) for client-specific subscription information about messages being distributed. Commonly, this will happen over message-oriented middleware buses, multicast channels, or feeds.

• Complete Mediation

• Use Authentication Mechanisms, Where Appropriate, Correctly
• Use Authorization Mechanisms Correctly: this refers to Ambiguity of authentication. Many authorization systems use ambiguous symbols (i.e., principal names) to identify principals allowing circumvention of authorization by using a different, though equivalent, principal name. For example, there are many implementations for restricting remote host access to local services that may allow many proper—but apparently different—names for unique hosts (e.g., fully qualified domain names, shortened names, CNAMEs, IPv4 addresses, IPv6 addresses).

Penetration

13

Very High

An environment variable is accessible to the user.

An environment variable used by the application can be tainted with user supplied data.

Input data used in an environment variable is not validated properly.

The variables encapsulation is not done properly. For instance setting a variable as public in a class makes it visible and an attacker may attemp to manipulate that variable.

Very High

• Injection
• Modification of Resources
• Protocol Manipulation

Low: In a web based scenario, the client controls the data that it submitted to the server. So anybody can try to send malicious data and try to bypass the authentication mechanism.

Medium/High: Some more advanced attacks may require knowledge about protocols and probing technique which help controling a variable. The malicious user may try to understand the authentication mechanism in order to defeat it.

An attacker can intentionally modify the client side parameter and monitor how the server behaves in response to that modification. For instance an attacker will look at the cookie data, the URL parameters, the hidden variables in forms, variables used in system calls, etc.

If the client uses a program in binary format to connect to the server, disassembler can be used to identify parameter within the binary code, and then the attacker would try to simulate the client application and change some of the parameters sent to the server. For instance the attacker may find that a secret key or a path is hard coded in the binary client application.

Environment variables are frequently stored in cleartext configuration files. If the attacker can modify those configuration files, he can control the environment variables. Even a read access can potentially be dangerous since this may give sensitive information to perform this type of attack. Indeed knowing which environment variables the application uses is a prerequisite to this type of attack.

The attacker may try to obfuscate its attempts to subvert the target process (such as authentication) by using valid values for the variable she controls. By using valid values the user tries to understand the authentication mechanism. This would be in preparation to a more serious attack.

Protect environment variables against unauthorized read and write access.

Protect the configuration files which contain environment variables against illegitimate read and write access.

Assume all input is malicious.  Create a white list that defines all valid input to the software system based on the requirements specifications.  Input that does not match against the white list should not be permitted to enter into the system.

Apply the least privilege principles. If a process has no legitimate reason to read an environment variable do not give that privilege.

• Run Arbitrary Code
• Privilege Escalation
• Denial of Service
• Information Leakage

The client controlled parameter

The new value of the client controlled parameter.

The activation zone is the server side function where the client controlled parameter is consumed.

Consuming an attacker contolled parameter can defeat the normal process of the application.

• Reluctance to trust

• Always perform wise data validation. Do not accept tainted data without validation. Do not simply base authentication on the client controlled parameter.
• Avoid relying on client side validation only.

Penetration

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

CWE - Input Validation

15

High

Software's input validation or filtering must not detect and block presence of additional malicious command.

High

• Injection

Medium: The attacker has to identify injection vector, identify the specific commands, and optionally collect the output, i.e. from an interactive session.

Ability to communicate synchronously or asynchronously with server. Optionally, ability to capture output directly through synchronous communication or other method such as FTP.

Design: Perform whitelist validation against a positive specification for command length, type, and parameters.

Design: Limit program privileges, so if commands circumvent program input validation or filter routines then commands do not running under a privileged account

Implementation: Perform input validation for all remote content.

Implementation: Use type conversions such as JDBC prepared statements.

• Run Arbitrary Code
• Information Leakage

"Attack Pattern: Command Delimiters
"Using the semicolon or other off-nominal characters, multiple commands can be strung together. Unsuspecting target programs will execute all the commands."
[Hoglund and McGraw 04]

Malicious input delivered through appending delimiters to standard input

Command(s) appended to valid parameters to enable attacker to execute commands on host

Client machine and client network

Enables attacker to execute server side code with any commands that the program owner has privileges to.

Penetration

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

97

Very High

The target software utilizes some sort fo cryptographic algorithm.

An underlying weaknesses exists either in the cryptographic algorithm used or in the way that it was applied to a particular chunk of plaintext.

The encryption algorithm is known to the attacker.

An attacker has access to the ciphertext.

Very Low

• Analysis
• Brute Force

High - Cryptanalysis generally requires a very significant level of understanding of mathematics and computation.

Computing resource requirements will vary based on the complexity of a given cryptanalysis technique.  Access to the encryption/decryption routines of the algorithm is also required.

Use proven cryptographic algorithms with recommended key sizes.

Ensure that the algorithms are used properly.  That means:

1.  Not rolling out your own crypto;  Use proven algorithms and implementations.
2.  Choosing initialization vectors with sufficiently random numbers
3.  Generating key material using good sources of randomness and avoiding known weak keys
4.  Using proven protocols and their implementations.
5.  Picking the most appropriate cryptographic algorithm for your usage context and data

• Information Leakage
• Data Modification
• Privilege Escalation

Reconnaissance

Wikipedia (Cryptanalysis): www.wikipedia.org

17

Very High

System's configuration must allow an attacker to directly access executable files or upload files to execute. This means that any access control system that is supposed to mediate communications between the subkect and the object is set incorrectly or assumes a benign environment.

High

• Modification of Resources
• API Abuse

Low: to identify and execute against an overprivileged system interface

Ability to communicate synchronously or asynchronously with server that publishes an overprivileged directory, program, or interface. Optionally, ability to capture output directly through synchronous communication or other method such as FTP.

Design: Enforce principle of least privilege

Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.

Implementation: Perform testing such as pentesting and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.

• Run Arbitrary Code
• Data Modification
• Information Leakage
• Privilege Escalation

"Attack Pattern: Direct Access to Executable Files
A privileged program is directly accessible. The program performs operations on behalf of the attacker that allow privilege escalation or shell access. For Web servers, this is often a fatal issue. If a server runs external executables provided by a user (or even simply named by a user), the user can cause the system to behave in  unanticipated ways.  This may be accomplished by passing in command-line options or by spinning an interactive session. A problem like this is almost always as bad as giving complete shell access to an attacker.

The most common targets for this kind of attack are Web servers. The attack is so easy that attackers have been known to use Internet search engines to find potential targets. The Altavista search engine is a great resource for attackers looking for such targets. Google works too."
[Hoglund and McGraw 04]

Payload delivered through standard communication protocols.

Command(s) executed directly on host

Client machine and client network

Enables attacker to execute server side code with any commands that the program owner has privileges to.

Penetration

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

20

Low

Ciphertext is known.

Encryption algorithm and key size are known.

Low

• Brute Force

Low:  Brute forcing encryption does not require much skill.

A powerful enough computer for the job with sufficient CPU, RAM and HD.  Exact requirements will depend
on the size of the brute force job and the time requirement for completion.  Some brute forcing jobs may require grid or distributed computing (e.g. DES Challenge).

On average, for a binary key of size N, 2^(N/2) trials will be needed to find the key that would decrypt the ciphertext to obtain the original plaintext.
Obviously as N gets large the brute force approach becomes infeasible.

None.  This attack happens offline.

Use commonly accepted algorithms and recommended key sizes.  The key size used will depend on how important it is to keep the data confidential and for how long.

In theory a brute force attack performing an exhausitve keyspace search will always succeed, so the goal is to have computational security.  Moore's law needs to be taken into account that suggests that computing resources double every eighteen months.

• Information Leakage

Typically cryptography, if done right, will rarely be the weakest link in the system.  Problems begin when people either decide to play cryptographers themselves and roll out custom crypto, use key sizes that are too small, develop their own cryptographic protocols (or misuse existing cryptographic protocols).  There are some other things that can be done wrong, such as not using good sources of randomness when generating encryption keys and initialization vector values.

21

High

Server software must rely on weak session IDs proof and/or verification schemes

High

• Spoofing
• API Abuse
• Injection

Low: To achieve a direct connection with the weak or non-existent server session access control, and pose as an authorized user

Ability to deploy software on network. Ability to communicate synchronously or asynchronously with server

Design: utilize strong federated identity such as SAML to encrypt and sign identity tokens in transit.

Implementation: Use industry standards session key generation mechanisms that utilize high amount of entropy to generate the session key. Many standard web and application servers will perform this task on your behalf.

Implementation: If the session identifier is used for authentication, such as in the so-called single sign on use cases, then ensure that it is protected at the same level of assurance as authentication tokens.

Implementation: If the web or application server supports it, then encrypting and/or signing the session ID (such as cookie) can protect the ID if intercepted.

Design: Use strong session identifiers that are protected in transit and at rest.

Implementation: Utilize a session timeout for all sessions, for example 20 minutes. If the user does not explicitly logout, the server terminates their session after this period of inactivity. If the user logs back in then a new session key is generated.

Implementation: Verify of authenticity of all session IDs at runtime.

• Privilege Escalation
• Information Leakage
• Data Modification

"Attack Pattern: Session ID, Resource ID, and Blind Trust

When session and resource IDs are simple and available, attackers can use them to their advantage. Many schemes are so simple that pasting in another known ID in a message stream works.

[Hoglund and McGraw 04]

Malicious input delivered through standard service calls, e.g. FTP or posting a message to a message queue.

Varies with instantiation of attack pattern. The main goal is so spoof or impersonate a legitimate user.

Client machine and client network (e.g. Intranet)

Enables attacker to impersonate another user and access commands and data (and log behavior to audit logs) on their behalf.

Penetration

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

23

Very High

The target software must consume files.

The attacker must have access to modify files that the target software will consume.

High

• Injection
• API Abuse

Medium

Design: Enforce principle of least privilege

Design: Validate all input for content including files. Ensure that if files and remote content must be accepted that once accepted, they are placed in a sandbox type location so that lower assurance clients cannot write up to higher assurance processes (like Web server processes for example)

Design: Execute programs with constrained privileges, so parent process does not open up further vulnerabilities. Ensure that all directories, temporary directories and files, and memory are executing with limited privileges to protect against remote execution.

Design: Proxy communication to host, so that communications are terminated at the proxy, sanitizing the requests before forwarding to server host.

Implementation: Virus scanning on host

Implementation: Host integrity monitoring for critical files, directories, and processes. The goal of host integrity monitoring is to be aware when a security issue has occurred so that incident response and other forensic activities can begin.

• Run Arbitrary Code

"Attack Pattern: File System Function Injection, Content Based
A protocol header or snippet of code embedded in a media file is used in a trusted function call when the file is opened by the client. Examples include music files such as MP3, archive files such as ZIP and TAR, and more complex files such as PDF and Postscript files. Common targets for this attack are Microsoft Word and Excel files, most often delivered as e-mail attachments.

An attacker typically makes use of relative paths in ZIP, RAR, TAR archive, and decompresses to get to parent directories."

[Hoglund and McGraw 04]

Payload delivered through standard communication protocols.

Command(s) executed directly on host filesystem

Client machine and client network

Enables attacker to execute server side code with any commands that the program owner has privileges to.

Exploitation

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

25

High

The target host has a deadlock condition. There are four conditions for a deadlock to occur, known as the Coffman conditions (See reference, Wikipedia)

The target host exposes an API to the user.

Low

• Analysis
• API Abuse

Medium/High: This type of attack may be sophisticated and require knowledge about the system's resources and APIs.

The attacker can probe by trying to hold resources and call APIs which are directly using the same resources.

The attacker may try to find actions (threads, processes) competing for the same resources.

Use known algorithm to avoid deadlock condition (for instance non-blocking synchronization algorithms).

For competing actions use well known libraries which implement synchronization.

• Denial of Service

Exploitation

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

CWE - Unrestricted Critical Resource Lock

Deadlock, http://en.wikipedia.org/wiki/Deadlock

92

High

The attacker can manipulate the value of an integer variable utilized by the target host.

The target host does not do proper range checkingon the variable before utilizing it.

When the integer variable is incremented or decremented to an out of range value, it gets a very different value (e.g. very small or negative number)

High

• Modification of Resources
• Injection
• API Abuse
• Analysis

Low : An attacker can simply overflow an integer by inserting an out of range value.
High : Exploiting a buffer overflow by injecting malicious code into the stack of a software system or even the heap can require a higher skill level.

Vulnerability testing tool can be used to probe for integer overflow (e.g. fuzzer).

Use a language or compiler that performs automatic bounds checking.

Carefully review the service's implementation before making it available to user. For instance you can use manual or automated code review to uncover vulnerabilities such as integer overflow.

Use an abstraction library to abstract away risky APIs. Not a complete solution.

Always do bound checking before consuming user input data.

• Data Modification
• Privilege Escalation
• Run Arbitrary Code
• Information Leakage
• Denial of Service

An integer overflow condition exists when an integer, which has not been properly sanity checked is used in the determination of an offset or size for memory allocation, copying, concatenation, or similarly. If the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value.

The user supplied data.

The integer overrun by the attacker.

When the function use the integer as offset, the offset may be out of the expected range which may lead to unexpected behavior such as issues of availability.

The most common are issues of availability. In some situation, an integer oveflow can turn out to be an exploitable buffer overflow, then the attacker may be able to run arbitrary code on the target host.

• Reluctance to Trust

Exploitation

J. Viega and G. McGraw. Building Secure Software. Addison-Wesley, 2002.

CWE - Integer overflow (wrap or wraparound)

Integer overflow, Secure Software - http://www.owasp.org/index.php/Integer_overflow

SAMATE : samate.nist.gov

26

High

A resource is accessed/modified concurrently by multiple processes such that a race condition exists.

The attacker has the ability to modify the resource.

High

• Time and State
• Modification of Resources

Medium/High

Vulnerability testing tool can be used to probe for race condition.

The attacker may also look for temporary file creation. The attacker may tries to replace them and take advantage of a race condition.

Use safe libraries to access resources such as files.

Be aware that improper use of access function calls such as chown(), tempfile(), chmod(), etc. can cause a race condition.

Use synchronization to control the flow of execution.

Use static analysis tools to find race conditions.

Pay attention to concurrency problems related to the access of resources.

• Privilege Escalation
• Data Modification

Exploitation

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

CWE - Race Conditions

Wikipedia, http://en.wikipedia.org/wiki/Race_condition

David Wheeler - Prevent race conditions - http://www-128.ibm.com/developerworks/linux/library/l-sprace.html

David Wheeler - Secure programming - http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/avoid-race.html

87

High

The forcibly browsable pages or accessible resources must be discoverable and improperly protected.

Very High A number of automated crawlers as well as other tools are available that generally perform a good job at looking for forcefully browsable pages

• Brute Force

Low: Forcibly browsable pages can be discovered by using a number of automated tools. Doing the same manually is tedious but by no means difficult

A directory listing is helpful but not a requirement. No special resources are required.

Following all the links recursively reveals resources that are available

Having a directory listing also points to the available pages and resources in the application that may be forcibly browsable.

Authenticate request to every resource. In addition, every page or resource must ensure that the request it is handling has been made in an authorized context.

Forceful browsing can also be made difficult to a large extent by not hard-coding names of application pages or resources. This way, the attacker cannot figure out, from the application alone, the resources available from the present context.

• Information Leakage
• Privilege Escalation

Forceful browsing is a consequence of improper access control. The application is designed with an assumption that resources are to be accessed in a certain sequence and that this sequence is immutable.

Pages in an application can request the client's identity each time a request is made or can rely on a controller or filter to do it for them before passing on the request.

Often times, however, when pages are modified or new pages are added to an application, the access control logic is not updated simultaneously. This opens up an avenue for attackers to bypass the authentication mechanism and access such pages directly.

Another cause is multiple access routes to the same resource, not all of which are equally well protected.

• Complete Mediation
• Reluctance To Trust

• Treat the Entire Inherited Process Context as Unvalidated Input
• Use Authentication Mechanisms, Where Appropriate, Correctly

28

Medium

High

• Analysis
• Injection
• Brute Force

Low:  There is a wide variety of fuzzing tools available.

Fuzzing tools.

A lot of invalid data is fed to the system.  Data that cannot have been generated through a legitimate transaction/request.  Data is coming into the system within a short period of time and potentially from the same IP.

Take pauses between fuzzing attempts (may not be very practical).  Spoof IP addresses so that it does not look like all data is coming from the same source.

Test to ensure that the software behaves as per specification and that there are no unintended side effects.  Ensure that no
assumptions about the validity of data are made.

Use fuzz testing during the software QA process to uncover any surprises, uncover any assumptions or unexpected behavior.

• Data Modification
• Denial of Service
• Information Leakage
• Privilege Escalation
• Run Arbitrary Code

Reconnaissance

29

High

A resource is access/modified concurrently by multiple processes.

The attacker is able to modify resource.

A race condition exists while accessing a resource.

High

• Time and State
• Modification of Resources

Medium/High: This attack can get sophisticated since the attack has to occur within a short interval of time.

Vulnerability testing tool can be used to probe for race condition.

The attacker may also look for temporary file creation. The attacker may try to replace them and take advantage of a race condition.

Use safe libraries to access resources such as files.

Be aware that improper use of access function calls such as chown(), tempfile(), chmod(), etc. can cause a race condition.

Use synchronization to control the flow of execution.

Use static analysis tools to find race conditions.

Pay attention to concurrency problems related to the access of resources.

• Data Modification
• Privilege Escalation
• Run Arbitrary Code
• Information Leakage
• Denial of Service

The window of time between when a file property is checked and when the file is used can be exploited to launch a privilege escalation attack.

File access race conditions, known as time-of-check, time-of-use (TOCTOU) race conditions, occur when:

   1. The program checks a property of a file, referencing the file by name.
   2. The program later performs a filesystem operation using the same filename and assumes that the previously-checked property still holds.

Example: The following code is from a program installed setuid root. The program performs certain file operations on behalf of non-privileged users, and uses access checks to ensure that it does not use its root privileges to perform operations that should otherwise be unavailable to the current user. The program uses the access() system call to check if the person running the program has permission to access the specified file before it opens the file and performs the necessary operations.

     if(!access(file,W_OK)) {
          f = fopen(file,"w+");
          operate(f);
          ...
     }
     else {
          fprintf(stderr,"Unable to open file %s.\n",file);
     }

The call to access()behaves as expected, and returns 0if the user running the program has the necessary permissions to write to the file, and -1 otherwise. However, because both access() and fopen() operate on filenames rather than on file handles, there is no guarantee that the file variable still refers to the same file on disk when it is passed to fopen() that it did when it was passed to access(). If an attacker replaces file after the call to access() with a symbolic link to a different file, the program will use its root privileges to operate on the file even if it is a file that the attacker would otherwise be unable to modify. By tricking the program into performing an operation that would otherwise be impermissible, the attacker has gained elevated privileges.

This type of vulnerability is not limited to programs with root privileges. If the application is capable of performing any operation that the attacker would not otherwise be allowed perform, then it is a possible target.

The window of vulnerability for such an attack is the period of time between when the property is tested and when the file is used. Even if the use immediately follows the check, modern operating systems offer no guarantee about the amount of code that will be executed before the process yields the CPU. Attackers have a variety of techniques for expanding the length of the window of opportunity in order to make exploits easier, but even with a small window, an exploit attempt can simply be repeated over and over until it is successful.

• Least Privilege

Exploitation

J. Viega and G. McGraw. Building Secure Software. Addison-Wesley, 2002.

CWE - Input Validation

30

Very High

The application in question employs a threaded model of execution with the threads operating at, or having the ability to switch to, a higher privilege level than normal users

In order to feasibly execute this class of attacks, the attacker must have the ability to hijack a privileged thread. This ability includes, but is not limited to, modifying environment variables that affect the process the thread belongs to, or providing malformed user-controllable input that causes the executing thread to fault and return to a higher privilege level or such. This does not preclude network-based attacks, but makes them conceptually more difficult to identify and execute.

Low

• Analysis
• Modification of Resources
• API Abuse

High: Hijacking a thread involves knowledge of how processes and threads function on the target platform, the design of the target application as well as the ability to identify the primitives to be used or manipulated to hijack the thread.

The attacker needs to be able to latch onto a privileged thread. No special hardware or software tool-based resources are required.

The Attacker does, however, need to be able to program, compile, and link to the victim binaries being executed so that it will turn control of a privileged thread over to the Attacker's malacious code. This is the case even if the attacker conducts the attack remotely.

The attacker may attach a debugger to the executing process and observe the spawning and clean up of threads, as well as the switches in privilege levels

The attacker can also observe the environment variables, if any, that affect executing threads and modify them in order to observe their effect on the execution.

Application Architects must be careful to design callback, signal, and similar asynchronous constructs such that they shed excess privilege prior to handing control to user-written (thus untrusted) code.

Application Architects must be careful to design privileged code blocks such that upon return (successful, failed, or unpredicted) that privilege is shed prior to leaving the block/scope.

• Privilege Escalation
• Run Arbitrary Code

This pattern applies to circumstances in which the Attacker knows the victim API and can compile, link, and deploy code in which the victim's privileged threads will call malicious code. This, in most circumstances, will involve being 'in process' with the victim. The pattern does, however, apply in network-based circumstances in which remote object/callback interaction is allowed through RPC-like technologies. In either case (local or remote) the Attacker must be able to gain control of the thread through 'normal' means, which may require privilege-enough to register a call back, subscribe to a service, or similar.

Only those constructs within the application that cannot execute without elevated privileges must be granted additional privileges. Often times, the entire function or the entire process is granted privileges that are usually not necessary.

The callee must ensure that additional privileges are shed before returning to the caller. This avoids pinning the responsibility on an inadvertant caller who may not have a clue about the innards of the callee.

• Least Privilege
• Complete Mediation

• Minimize privileged code blocks
• Shed any privileges not required to execute at the earliest
• Treat the Entire Inherited Process Context as Unvalidated Input

Exploitation

35

Very High

The attacker must have the ability to modify nonexecutable files consumed by the target software.

High

• Injection
• API Abuse
• Modification of Resources

Low: to identify and execute against an overprivileged system interface

Ability to communicate synchronously or asynchronously with server that publishes an overprivileged directory, program, or itnerface. Optionally, ability to capture output directly through synchronous communication or other method such as FTP.

Design: Enforce principle of least privilege

Design: Run server interfaces with a non-root account and/or utilize chroot jails or other configuration techniques to constrain privileges even if attacker gains some limited access to commands.

Implementation: Perform testing such as pentesting and vulnerability scanning to identify directories, programs, and interfaces that grant direct access to executables.

Implementation: Implement host integrity monitoring to detect any unwanted altering of configuration files.

Implementation: Ensure that files that are not required to execute, such as configuration files, are not over-privileged, i.e. not allowed to execute.

• Run Arbitrary Code
• Data Modification
• Privilege Escalation

"Attack Pattern: Leverage Executable Code in Nonexecutable Files

Attackers usually need to upload or otherwise inject hostile code into a target processing environment. In some cases, this code does not have to be inside an executable binary. A resource file, for example, may be loaded into a target process space. This resource file may contain graphics or other data and may not have been intended to be executed at all. But, if the attacker can insert some additional code sections into the resource, the process that does the loading may be none the wiser and may just load the new version. An attack can then occur."

[Hoglund and McGraw 04]

Nonexecutable files

Executable code

Client machine and client network

Enables attacker to execute server side code with any commands that the program owner has privileges to.

Exploitation

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

37

Very High

In order to feasibly execute this class of attacks, some valuable data must be present in client software.

Additionally, this information must be unprotected, or protected in a flawed fashion, or through a mechanism that fails to resist reverse engineering, statistical, cryptanalytic, or other attack.

Very High

• Analysis

Medium: The attacker must possess knowledge of client code structure as well as ability to reverse-engineer or decompile it or probe it in other ways. This knowledge is specific to the technology and language used for the client distribution

The attacker must possess access to the client machine or code being exploited. Such access, for this set of attacks, will likely be physical. The attacker will make use of reverse engineering technologies, perhaps for data or to extract functionality from the binary. Such tool use may be as simple as "Strings" or a hex editor. Removing functionality may require the use of only a hex editor, or may require aspects of the toolchain used to construct the application: for instance the Adobe Flash development environment. Attacks of this nature do not require network access or undue CPU, memory, or other hardware-based resources.

Attackers may confine (and succeeed with) probing as simple as deleting a cache or data file, or less drastically twiddling its bits and then testing the mutation's effect on an executing client.

At the other extreme, attackers capable of reverse engineering client code will have the ability to remove functionality or identify the whereabouts of sensitive data through whitebox analysis, such as review of reverse-engineered code.

• Information Leakage
• Data Modification
• Privilege Escalation

This pattern of attacks possesses valid contexts regardless of architectural model, as long as some client side logic or data of interest exists.

Client/server, n-tier and thick clients should all be considered for vulnerability to this pattern. Counter-indications include multicast distribution channels in which servers dispense only public data and no client-side authentication or filtering occurs.

This pattern of attack need not depend on a particular platform, technology stack, or language.

This pattern of attacks possesses no injection vector, in its normal instances, as it affects clients fundamentally vulnerable to client-side trust issues. One exception to this rule exists: attacks making use of second-order injection attacks (SQL, XSS, or similar command injection) may 'deliver' an attack, through an intermediate server or data store, to a peer-client, or another user's use of the same client. In the case of the second instance (another user's use) this vector seems onerous but would be necessary in circumstances in which the hosting system protects the application well but implicitly trusts (potentially malicious) data received from the server (such as may be the case in kiosks well-protected through physical means).

Client-side software, whether it be a monolithic application, client/server, or n-tier (web-based).

No sensitive or confidential information must be stored in client distributions. This includes content such as passwords or encryption keys. In cases where this is necessary, avoid storing any such information in plaintext

All information arriving from a client must be validated before use.

• Reluctance to Trust
• Never Assuming that Your Secrets Are Safe

• Never Use Unvalidated Input as Part of a Directive to any Internal Component
• Treat the Entire Inherited Process Context as Unvalidated Input
• Use Well-Known Cryptography Appropriately and Correctly

Reconnaissance

Exploitation

93

High

The target host is logging the action and data of the user.

The target host insufficiently protects acces to the logs or loggin mechanisms.

High

• Analysis
• Modification of Resources
• Injection

Low/Medium:
Low: This attack can be as simple as adding extra characters to the logged data (e.g. unsername). Adding entries is typically easier than removing entries.
Medium: A more sophisticated attack can try to defeat the input validation mechanism.

The attacker will try to determine which data may be logged in case of a success or failure of a predetermined action such as authentication. Once that data has been identified, the attacker may try to craft malicious data to inject.

Vulnerability testing tool can be used to test the input validation mechanism.

Carefully control access to physical log files.

Do not allow tainted data to be written in the log file without prior input validation. Whitelisting may be used to properly validate the data.

Use synchronization to control the flow of execution.

Use static analysis tools to identify log forging vulnerabilities.

Avoid viewing logs with tools that may interpret control characters in the file, such as command-line shells.

• Data Modification

The variable being logged

The malicious characters or the crafted data which should forge the log entry.

The logging mechanism (This can be as simple as writing to a file, logging API, etc.)

Log tampering or forgery (misleading data)

• Reluctance to Trust

Obfuscation

J. Viega and G. McGraw. Building Secure Software. Addison-Wesley, 2002.

CWE - Log Forging

A. Muffet. The night the log was forged. http://doc.novsu.ac.ru/oreilly/tcpip/puis/ch10_05.htm.

Secure Software - Log Injection : http://www.owasp.org/index.php/Log_injection

Samate test case on Log Forging : http://samate.nist.gov/SRD/view_testcase.php?login=Guest&tID=1579

38

Very High

The attacker must be able to write to redirect search paths on the victim host.

High

• Modification of Resources

Low: to identify and execute against an overprivileged system interface

Design: Enforce principle of least privilege

Design: Ensure that the program's compound parts, including all system dependencies, classpath, path, and so on, are secured to the same or higher level assurance as the program

Implementation: Host integrity monitoring

• Run Arbitrary Code
• Privilege Escalation

"Attack Pattern: Make Use of Configuration File Search Paths

If you place a copy of the configuration file into a previously empty location, the target program may find your version first and forgo any further searching. Most programs are not aware of security, so no check will be made against the owner of the file. The UNIX environment variable for PATH will sometimes specify that a program should look in multiple directories for a given file. Check these directories to determine whether you can sneak a Trojan file into the target."

[Hoglund and McGraw 04]

Exploitation

G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.

94

Very High

There are two components communicating with each other.

An attacker is able to identify the nature and mechanism of communication between the two target components.

An attacker can eavesdrop on the communication between the target components.

Strong mutual authentication is not used between the two target components yielding opportunity for attacker interposition.

The communication occurs in clear (not encrypted) or with insufficient and spoofable encryption.

Very High

• Spoofing
• Analysis
• Modification of Resources

Medium/High: This attack can get sophisticated since the attack may use cryptography.

The attacker can try to get the public-keys of the victims.

There are free software tool to perform man in the middle attack (packet anlaysis, etc.)

Get your Public Key signed by a Certificate Authority

Encrypt your communication using cryptography (SSL,...)

Use Strong mutual authentication to always fully authenticate both ends of any communications channel.

Exchange public keys using a secure channel

• Data Modification
• Privilege Escalation
• Information Leakage

A certificate binds an identity to a cryptographic key to authenticate a communicating party. Often, the certificate takes the encrypted form of the hash of the identity of the subject, the public key, and information such as time of issue or expiration using the issuer's private key. The certificate can be validated by deciphering the certificate with the issuer's public key. See also X.509 certificate signature chains and the PGP certification structure.

The captured or modified data in transit

The new value of the data or the replay of the same data (e.g. credential)

The messages exchanged between the two target hosts.

Privilege escalation. modification of resource, information leakage, etc.

• Complete Mediation

Exploitation

CWE - Man-in-the-middle (MITM)

M. Bishop. Computer Security: Art and Science. Addison-Wesley, 2003.

39

Medium

An attacker already has some access to the system or can steal the client based data tokens from another user who has access to the system.

For an Attacker to viably execute this attack, some data (later interpreted by the application) must be held client-side in a way that can be manipulated without detection. This means that the data or tokens are not CRCd as part of their value or through a separate meta-data store elsewhere.

Very High

• Modification of Resources

Medium:  If the client site token is obfuscated.
High:  If the client site token is encrypted.

The Attacker needs no special hardware-based resources in order to conduct this attack. Software plugins, such as Tamper Data for Firefox, may help in manipulating URL- or cookie-based data.

Tamper with the client side data token and observe the effects it has on interaction with the system.

This attack is in and of itself a trial-and-error-based probing technique.

One solution to this problem is to protect encrypted data with a CRC of some sort. If knowing who last manipulated the data is important, then using a cryptographic "message authentication code" (or hMAC) is prescribed. However, this guidance is not a panecea. In particular, any value created by (and therefore encrypted by) the client, which itself is a "malicous" value, all the protective cryptography in the world can't make the value 'correct' again. Put simply, if the client has control over the whole process of generating and encoding the value--then simply protecting its integrity doesn't help.

Make sure to protect client side authentication tokens for confidentiality (encryption) and integrity (signed hash)

Make sure that all session tokens use a good source of randomness

Perform validation on the server side to make sure that client side data tokens are consistent with what is expected.

• Data Modification
• Privilege Escalation

The context in which this attack can operate is any circumstance in which important data, stored client-side, is reinterpreted by the client itself or a server-side component. The server-side component may or may not be the same system that produced the data (it is not in the given example instance). But, in all cases, the data stored is protected through some means--such as encryption. However, it's important to stipulate that the means used to protect this data does not employ an effetive integrity check.

Sensitive information stored client side must be integrity checked upon return before use

• Reluctance to Trust
• Never Assuming that your Secrets are Safe
• Least Privilege
• Complete Mediation

• Never Use Unvalidated Input as Part of a Directive to any Internal Component

Penetration

Exploitation

43

High

User input is used to construct a command to be executed on the target system or as part of the file name.

Multiple parser passes are performed on the data supplied by the user.

Medium

• Injection
• Modification of Resources

Medium

Initially a fuzzer can be used to see what the application is successfully and escaping and what causes problems.  This may be a good starting point.

Manually try to introduce multiple layers of control characters and see how many layers the application can escape.

Control characters are being detected by the filters repeatedly.

An iterative approach to input validation may be required to ensure that no dangerous characters are present.  It may be necessary to implement redundant checking across different input validation layers.  Ensure that invalid data is rejected as soon as possible and do not continue to work with it.

Make sure to perform input validation on canonicalized data (i.e. data that is data in its most standard form).  This will help avoid tricky encodings getting past the filters.

Assume all input is malicious.  Create a white list that defines all valid input to the software system based on the requirements specifications.  Input that does not match against the white list should not be permitted to enter into the system.

• Data Modification
• Privilege Escalation
• Information Leakage