Sensitive Data Exposure¶

What is Sensitive Data Exposure?¶

Banking information: account numbers, credit card numbers
Health information
Personal information: SSN/SIN, date of birth, etc.
User account/passwords

Causing:

Financial loss
Identity hijacking
Decreased brand trust

Sensitive Data Exposure examples¶

Example #1: Credit card encryption¶

An application encrypts credit card numbers in a database using automatic database encryption. However, this means it also decrypts this data automatically when retrieved, allowing a SQL injection flaw to retrieve credit card numbers in clear text.

Risk

The system should have encrypted the credit card numbers using a public key, and only allowed back- end applications to decrypt them with the private key.

Example #2: SSL is not used for all authenticated pages¶

Risk

Attacker simply monitors network traffic (like an open wireless network), and steals the user’s session cookie. Attacker then replays this cookie and hijacks the user’s session, accessing the user’s private data.

Example #3: The password database uses unsalted hashes to store everyone’s passwords¶

Risk

A file upload flaw allows an attacker to retrieve the password file. All of the unsalted hashes can be exposed with a rainbow table of precalculated hashes.

How to prevent Sensitive Data Exposure¶

Encrypt data during transport and at rest
Minimize data surface area
Use the latest encrytion algorithms
Disable autocomplete on forms that collect data
Disable caching on forms that collect data

How Hdiv protects against A6 risk¶

Risk Partially Covered

Hdiv provides utilities not to send sensitive data to the client and to detect insecure obfuscation techniques

Agent¶

Detects:

Insecure cipher algorithm usage
Form autocomplete activated

Library¶

Hdiv offers confidentiality to all data generated at the server side. That is to say, Hdiv replaces original parameter values generated at the server side by relative values (0,1,2,4, etc.) to avoid exposing critical data to the client.