Failure to Add Integrity Check Value

From Guidance Share

1 Description
2 Applies To
3 Example
4 Impact
5 Vulnerabilities
6 Countermeasures
7 Vulnerability Patterns
8 How Tos

Description

The failure to encrypt data passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.

[edit]

Applies To

Languages: Any
Operating platform: Any

[edit]

Example

The following example reads and writes sensitive network data without encrypting it:

server.sin_family = AF_INET;
hp = gethostbyname(argv[1]);
if (hp==NULL) error("Unknown host");
memcpy( (char *)&server.sin_addr,(char *)hp->h_addr,hp->h_length);
if (argc < 3) port = 80;
else port = (unsigned short)atoi(argv[3]);
server.sin_port = htons(port); 
if (connect(sock, (struct sockaddr *)&server, sizeof server) < 0)
error("Connecting");
...
while ((n=read(sock,buffer,BUFSIZE-1))!=-1){
write(dfd,password_buffer,n);

[edit]

Impact

Confidentiality: Properly encrypted data channels ensure data confidentiality.
Integrity: Properly encrypted data channels ensure data integrity.
Accountability: Properly encrypted data channels ensure accountability.

[edit]

Vulnerabilities

Failure to encrypt sensitive data

[edit]

Countermeasures

Requirements specification: require that encryption be integrated into the system.
Design: Ensure that encryption is properly integrated into the system design, not simply as a drop-in replacement for sockets.

[edit]