Failure to Check Integrity Check Value

From Guidance Share

Jump to: navigation, search

Contents

Description

If integrity check values (cryptographic hash) are omitted from a transmitted message, there is no way of determining if data has been corrupted in transmission.

Applies To

  • Languages: All
  • Platforms: All

Example

The following code shows an example of network data being sent without the use of an integrity check:

int r,s;
struct hostent *h;
struct sockaddr_in rserv,lserv;
h=gethostbyname("127.0.0.1");
rserv.sin_family=h->h_addrtype;
memcpy((char *) &rserv.sin_addr.s_addr, h->h_addr_list[0],h->h_length);
rserv.sin_port= htons(1008);
s = socket(AF_INET,SOCK_DGRAM,0);
lserv.sin_family = AF_INET;
lserv.sin_addr.s_addr = htonl(INADDR_ANY);
lserv.sin_port = htons(0);
r = bind(s, (struct sockaddr *) &lserv,sizeof(lserv));
sendto(s,important_data,strlen(improtant_data)+1,0,(struct sockaddr *)&rserv, sizeof(rserv));

An integrity check can be added as a hash of the data sent and can be added to the to the end of this message or sent seperately. You must encrypt the hash, or use an HMAC, to ensure that it is not modified by an attacker. Alternatively you can encrypt the entire message though this will have a larger performance impact.

Impact

  • Integrity: Data that is parsed and used may be corrupted.
  • Non-repudiation: Without a cryptographic hash it is impossible to determine if any changes have been made to the data after it was sent.

Vulnerabilities

  • Failure to add an integrity check to sensitive sent data.

Countermeasures

  • Design: Use a cryptographic hash (such as SHA256) or an HMAC when sending data for which you want to guarantee integrity. This ensures that data received may be simply validated before it is parsed and used.
  • Implementation: Ensure that the cryptographic hash, or HMAC, present in the message design are properly implemented, added to each message before being sent and are encrypted to ensure they may not be modified.

Vulnerability Patterns

How Tos

Personal tools