Application Security: Exploits & Vulnerabilities

• Malicious code and application attacks can exploit vulnerabilities in authentication systems.

Backdoor Vulnerabilities

• Backdoor vulnerabilities allow bypassing normal authentication.
• Anyone knowing the backdoor password gains access.
• If a backdoor becomes public, all code copies in production are compromised.

Hard-Coded Credentials

• Hard-coding credentials involves embedding access credentials for other services in source code.
• Accidental disclosure in public code repositories (like GitHub) exposes credentials.

Memory Management

• Applications manage memory, and poor practices undermine security.

Resource Exhaustion

• Resource exhaustion occurs when systems consume all available memory, storage, processing time, or other resources.
• This renders systems disabled or crippled.

Memory Leaks

• Memory leaks exemplify resource exhaustion.
• An application fails to return memory it no longer needs, consuming available memory and causing crashes.
• Rebooting temporarily fixes the issue, but the cycle restarts if the memory leak persists.

Pointer Dereferencing

• Pointers store addresses of other memory locations.
• Pointer dereferencing accesses the memory referenced by a pointer's address.

NULL Pointer Exceptions

• A null pointer is when a pointer is empty.
• Dereferencing a NULL pointer causes a null pointer exception.
• This may crash the program, giving attackers debugging information.
• In the worst case, it allows attackers to bypass security controls.
• Security professionals should work with developers to avoid these issues.

Error Handling - SQL Error Disclosure

• Overly verbose error handling routines can expose inner workings of code.

• Error handling routines may allow attackers to exploit the code.

• Error messages should display minimal information for the user.

• Applications should log detailed information for developers to investigate errors.

• A good general guideline is to display the minimum amount of information necessary for the user to understand the nature of the problem.

• Applications shoud then record as much information as possible for developers so they can correct the underlying issue.

Hard-Coded Credentials Part 2

• Developers may include usernames and passwords in source code.
• Developers may create hard-coded maintenance accounts for application access.

Source Code Comments

• Vulnerabilities can be introduced into code when remote users are allowed to view code comments.
• Comments should be removed from production code.

Error Handling in depth

• Must write code resilient to unexpected situations.
• Input validation alone isn't sufficient.
• Unexpected situations must be anticipated and handled with error handling code.
• Improper error handling exposes code to risks.

Try-Catch Functionality

• Many languages use try...catch functionality to specify error handling.

• Code that may cause errors is placed in a try clause.

• The catch clause specifies handling for the error situation.

• Cybersecurity professionals should embrace a defense-in-depth approach to security.

• Error handling serves as a secondary control to prevent malicious input from triggering dangerous error conditions.

Code Integrity Measurement

• This process verifies the code being released into production matches approved code using cryptographic hash functions.
• Deviations in hash values indicate code modification and require investigation.

Application Resilience

• Applications should be designed for resilience against changing demand.

Scalability

• Scalability means applications should be designed so that computing resources may be incrementally added to support increasing demand.
• Vertical scaling adds resources to an existing instance.
• Horizontal scaling adds instances to a pool.

Elasticity

• Elasticity means applications can automatically provision resources to scale when necessary and de-provision when not needed.

Secure Coding Practices

• Security issues remain consistent despite different development styles, languages, and frameworks.
• Common best practices are available to ensure software security.

Source Code Comments

• Comments are important for documentation, but can provide attackers a "road map".
• Comments can include critical security details.
• Commented code versions should remain secret.
• Compilers automatically remove comments from compiled executables.