Coders Conquer Security: Share & Learn Series - Sensitive Data Exposure

Sensitive data exposure has been responsible for some of the most publicized and impactful data breaches over the past few years, like the catastrophic Marriott breach wherein over 300 million customer records were stolen, and another 150 million when Equifax was attacked. There is a medium level of sophistication required, and sometimes special equipment on the part of the attacker, but it's not overly hard for a hacker to pull off in many cases, and tools exist to automate some of the attack functions.

Sensitive data exposure occurs whenever information that is only meant for authorized viewing is exposed to an unauthorized person in an unencrypted, unprotected, or weakly protected state. Most of the time this involves data that hackers want to steal such as credit card numbers, user identification, business secrets and personal information that might be protected by laws and industry regulations.

Hackers can steal sensitive information if it is stored without encryption or by indirectly attacking the encryption scheme. Instead of trying to decrypt strong encryption directly, they instead steal crypto keys, or attack data when it's moved to a non-encrypted state such as when it's being readied for transport.

In this episode we will learn:

• How attackers can trigger sensitive data exposure
• Why sensitive data exposure is so dangerous
• Techniques that can fix this vulnerability.

How do Attackers Exploit Sensitive Data Exposure?

Sensitive data exposure normally happens when sites don't employ strong end-to-end encryption to protect data, or when there are exploitable flaws in the protection scheme. It can also happen when the encryption used is particularly weak or outdated.

Hackers will often try and find ways to get around encryption if it's not extended everywhere. For example, if a user identity database stores information in an encrypted state, but automatically decrypts it when retrieved, a hacker might be able to use one of the attacks we previously covered in these blogs, such as SQL or XML injection, to order the database to perform the decryption process. Then the data would be decrypted for the hacker, with no additional effort required. Why try and break down a steel door when you can just pickpocket the key?

Weak encryption is also a problem. For example, if credit cards are stored using an outdated encryption scheme, it could be an issue if a hacker is able to use something like a local file inclusion vulnerability to pull the entire database over to their computer. If the captured data was protected using something strong like AES-256 bit encryption, then it would be much harder to break if it landed in a hacker's possession. But if weaker or outdated encryption is used, something like the older DES standard, then a hacker with special equipment such as a rack of graphics processing units (GPUs) can task them to break the encryption in a relatively short amount of time.

Why is Sensitive Data Exposure Dangerous?

Sensitive data exposure is dangerous because it lets unauthorized users see protected information. If the data wasn't important, it wouldn't be protected, so any breach of that protection is going to cause problems. It's never a situation that an organization wants to find itself facing.

How much trouble a sensitive data exposure can cause depends on the kind of data that gets exposed. If user or password data is stolen, then that could be used to launch further attacks against the system. Personal information exposure could subject users to secondary attacks such as identity theft or phishing. Organizations might even find themselves vulnerable to heavy fines and government actions if the exposed data is legally protected by statutes like the Health Insurance Portability and Accountability Act (HIPAA) in the United States or the General Data Protection Regulation (GDPR) in Europe.

Eliminating Sensitive Data Exposure

Stopping sensitive data exposure begins with ensuring strong, up-to-date and end-to-end encryption of sensitive data across an enterprise. This includes both data at rest and in transit. It's not enough to encrypt sensitive data while it sits in storage. If it is unencrypted before use or before transport, then it can be exposed using a secondary attack that tricks a server into unencrypting it.

Data in transit should always be protected using Transport Layer Security (TLS) to prevent exposure using man in the middle or other attacks against moving data. And sensitive data should never be cached anywhere in the network. Sensitive data should either be sitting with strong encryption in storage or sent using TLS protection, giving attackers no weak points to exploit.

Finally, do an inventory of the kinds of sensitive data that is being protected by your organization. If there is no reason for your organization to store such data, then dump it. Why expose yourself to potential trouble for no possible benefit? Data that isn't maintained by an origination can't be stolen from it.

More Information about Sensitive Data Exposure

For further reading, you can take a look at what OWASP says about sensitive data exposure. You can also put your newfound defensive knowledge to the test with the free demo of the Secure Code Warrior platform, which trains cybersecurity teams to become the ultimate cyber warriors. To learn more about defeating this vulnerability, and a rogues'gallery of other threats, visit the Secure Code Warrior blog.