Security of web applications

Main article: Security on the Internet

2020

BI.Zone and Ngenix announced the beginning of technology cooperation

On June 1, 2020 Ngenix, the provider of block services for web resources, reported that together with BI.Zone, Russian the developer of solutions in the field of cyber security, signed the agreement on cooperation in the field of a research and ensuring cyber security of public web applications. Read more here.

Rostelecom-Solar: about 70% of web applications contain critical vulnerabilities

On May 18, 2020 the Rostelecom-Solar company reported that it carried out the analysis of security of the web applications belonging to the organizations of the public and banking sector, the production area, information technologies, information security and others. About 70% of the studied appendices are contained by critical vulnerabilities which allow cybercriminals to get access to confidential data of the organization and users and also on behalf of the victim to make different transactions in vulnerable online services.

According to the company, the basis of a research was formed by the data obtained by experts Rostelecom-Solar during the cyberexercises, testings for penetration and projects according to the analysis of security. In total more than 30 web applications among which – the Internet portals of the companies, the system of remote banking, CRM and others were analyzed. Results demonstrate that the critical and easily operated vulnerabilities contain practically in each web application. The most part from them is connected with lack of filtering of the arriving data on the party of the Web server and also with shortcomings at the business logic layer of applications.

Nearly 70% of web applications were subject to IDOR vulnerabilities (Insecure direct object references is unsafe direct references on objects). Exploiting them, the malefactor can find method of search the identifiers used in a system and get unauthorized access to data of users. Most often this vulnerability meets in web applications with a difficult logical structure, for example, in the systems of remote banking. Successful operation of IDOR vulnerability in this case is able to allow the malefactor to obtain, for example, information on transactions and a status of accounts of users or to change data of their profiles.

As our practice, logical vulnerabilities shows, for example, the class IDOR, for May, 2020 meet more often others – the reason that it is very difficult to reveal the vulnerabilities connected with logic using code scanners. But they are also one of the most critical – malefactors can get data access of other users. In a case with banking systems it can be very sensitive information. Alexander Kolesov, the head of department of the analysis of security explained Rostelecom-Solar

For May, 2020 more than 50% of web applications contain shortcomings of filtering of the data arriving on the server that gives the chance to carry out attacks the XSS type (Cross-Site Scripting is cross-site accomplishment of scenarios). Such attacks, allow the malefactor to implement in the web page harmful JavaScript- the code which will be executed in browser the victims when opening the page. This code can interact with the Web server of the malefactor and transfer there, for example, cookie-files the user – with their help the malefactor can become authorized on internet- resources under credentials of the victim and to work from her name.

Another 30% of vulnerabilities are connected with a possibility of implementation of the SQL code because of absence or incorrect filtering of incoming requests from the user. At the expense of it the malefactor can receive control over the database of the organization and including access to confidential data of clients (for example, to passport details, the credit card, information on transactions, etc.) and an opportunity to change them directly on the server. In certain cases the malefactor can start accomplishment of the code of the operating system and by that to receive control over the server that will allow it to duplicate further all data in the storage. This type of vulnerability attracts the most serious risks of date leak (including personal and payment) and also financial and reputation losses.

These vulnerabilities exist long ago – for example, many years experts predict death to SQL injections, however even in updated applications for May, 2020 it is possible to meet this vulnerability. Protection of web applications – first of all, a task of the developer. You should not rely completely on means of protecting – in particular, Web Application Firewall cannot detect the attacks directed to vulnerabilities in logic of operation of application, for example, of IDOR. It is already necessary to observe at a stage of application creation the key principles of safe development: always to filter the data arriving from the user and to check access rights – at the level of Back-end, but not the client interface. Besides, it is necessary to carry out the analysis of security of the application periodically. Alexander Kolesov, the head of department of the analysis of security told Rostelecom-Solar

Read Also

• Security of the websites
• Security and problems of social networks
• Security on social networks
• Security of the software (S)

See Also