Welcome to sensitive data, exposure session. In
this first part. We will focus on threat analysis. We
will take our time to dig into sensitive data exposure, flaws details,
then we will discuss how the
system can be harmed. The impact of successful exploitation, and
give you some insights to identify who may want
to harm your system. Unfortunately data leaks
are becoming more and more frequent. Whether data is
sensitive is in general business specific, but there are
some data categories, considered sensitive.
Giving nature such as authentication credentials credit
card details and health records whenever
data isn't properly protected at rest or
in transit either internally and over the
internet. Then we're dealing with the sensitive data
exposure flow. Let me show you something.
This is a very simple, sensitive data, exposure scenario in
our intentionally vulnerable web application. The
second part. We will exploit this and other issues
notice that we access Jewish shop over HTTP
and not https. This
is how it works by Design, but it makes it possible to someone sitting
between the client and the server to spy exfiltrate
or temper with exchange data.
As you can see, the credit card number is masked on the screen giving
you a sense of security. Let's see, how client and
server exchange these data.
At the bottom of the screen, you can see that the server sent
all credit card details, including the number mask
on the screen in plain text. This means
that if there's someone sitting between our browser and the server, then
such actor already has our credit card
details. Probably you'll realize that at least
your internet service provider is always in
such position, but proxy servers and content. Delivery networks
are also common entities between our
browsers and the web application back and see.
Worse.
The credit card issue was quite obvious, but it
happens a lot. Sometimes you have to exploit other
vulnerabilities to uncover and protected data such as
authentication data stored in the database. We
will do it in the second part. But first, let's
discuss, attack vectors attackers may
not even need to touch your application together. Some sensitive data,
quite often, default credentials, keys, and
other tokens are pushed to public repositories. In
other cases, search engines are enough to reach
Database backup files logs or other sensitive documents
sitting between the client and the server is
a privileged position to access sensitive data, but
with the widespread adoption of HTTP attackers,
had to develop new techniques client side
attacks. Such as men in the browser or scraping are
common techniques together, sensitive data, directly
attacking cryptography is not an easy task unless
you're using old or weak algorithms, or
default, leaked, or we cryptographic.
He's and unfortunately this happens quite often
when sensitive data is exfiltrated from
your system. It is very likely that sooner or later.
It will be available in the internet or dark web. Depending
on systems nature. Expose data
may allow attackers to perpetrate social engineering attacks. Impersonating
your users, depending on the expose
data attackers, might be able to perpetrate some kind
of rods taking advantage of systems. Inability to
distinguish between malicious activity and the legit
Law enforcement is not exactly a technical impact,
but rather a business impact, nevertheless, due
to data protection, laws and regulations failing to
protect data. May result in huge losses. There
are autonomous systems crawling, the web searching for publicly
accessible data scanning, public source, code repositories
for leaked Secrets, or authentication tokens became
very popular access to sensitive data
does not mean sophisticated tools and techniques using
a search engine might be enough in virtually anyone.
And do it. Your data will always be
available to someone attackers know that. And
this is why Ransom became so popular and lots of
linked data is available for sale online. Keep
in mind that those inside your organization, may
have privileged access to sensitive information. There
are different motivations and they can change over time.
You'll find this table in the last top 10. Pause the
video and take your time to carefully, read it.
The next part, we will exploit our Target application
to reach some sensitive data.