Hello Everyone,
In this blog will explore about Encryption and Information disclousre.
Encryption
Weak cryptography
Countermeasure : Use well-proven encryption algorithms (e.g. AES) in well-proven libraries instead of inventing and implementing your own algorithm. Protect your key.
Failure to encrypt the messages
You don’t use encryption, the attackers can capture your authentication token and use it to impersonate you.
Countermeasure : Use encryption (e.g. SSL or WSS & XML-Encryption)
Messages are not protected in the immediateries
You use point to point encryption SSL but inside the intermmediateries your message is decrypted. The immediateries can read your sensitive data and use it for his advantage.
Countermeasure : Use end to end encryption (WSS & XML-Encryption)
Data tampering
An attacker modifies your message for his advantage.
Countermeasure : signature and encryption (WSS & XML-Encryption)
Schema poisoning/ metadata spoofing
Maliciously changing the WSDL (e.g. to redirect the service address to malicious web, to manipulate data types, to remove security policy) or manipulating the security policy document (to lower security requirement).
Countermeasure: check the authenticity of metadata (e.g. signing), use SSL to avoid man in the middle attack
Repudiation
A client refuses to acknowledge that he has misused the user-aggreement (e.g. perform dictionary attack against web-service authentication).
Countermeasure : keep client message signature in the log. Protect the log files.
Information disclosure
WSDL disclosure
WSDL contains many information for the attacker (operations, message format).
Countermeasure: protect the wsdl endpoint with ACL/firewall. Use robot.txt to avoid the wsdl appears in google.
UDDI disclosure
UDDI gives the attacker information about wsdl location.
Countermeasure: don’t publish the wsdl in UDDI
Error message
Attacker send failure messages/DOS attack such that the web service will return error messages which can reveal information (e.g. database server address, database vendor).
Countermeasure: don’t publish sensitive information (e.g. connection string) in the error message. Sanitize error message (e.g. the stacktrace)
Thankyou.