This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Top 10 2014-I5 Privacy Concerns"

From OWASP
Jump to: navigation, search
(Created page with "<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=OWASP_Internet_of_Things_Top_10_for_2014 Back To The Internet of Things Top 10]</center> ...")
 
 
(25 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=OWASP_Internet_of_Things_Top_10_for_2014 Back To The Internet of Things Top 10]</center>
+
<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_10_IoT_Vulnerabilities__282014_29 Back To The Internet of Things Top 10]</center>
  
 
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
 
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
−
{{Top_10:SummaryTableTemplate|exploitability=1|prevalence=2|detectability=2|impact=1|year=2013|language=en}}
+
{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=1|impact=1|year=2013|language=en}}
 
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
 
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the web interface including external users, internal users, and administrators.
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the device itself, the network the device is connected to, the mobile application and the cloud connection including external and internal users.
  
 
</td>
 
</td>
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Attacker uses weak default credentials, captures plain-text credentials or enumerates accounts to access the web interface. Depending on setup, attack could come from external or internal users.
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Attacker uses multiple vectors such as insufficient authentication, lack of transport encryption or insecure network services to view personal data which is not being properly protected or is being collected unnecessarily. Attack could come from external or internal users.
  
 
</td>
 
</td>
−
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>An insecure web interface is present when easy to guess or well known default credentials are used. Insecure web interfaces are prevalent as manufacturers strive to make interfaces easier for users to use and assume these interfaces will not be exposed to external users. They are often found in devices which have features that can only be accessed via the web interface. Issues with the web interface are easy to discover when examining the interface manually and frequently easy to discover via automated testing.
+
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Privacy concerns generated by the collection of personal data in addition to the lack of proper protection of that data is prevalent. Privacy concerns are easy to discover by simply reviewing the data that is being collected as the user sets up and activates the device. Automated tools can also look for specific patterns of data that may indicate collection of personal data or other sensitive data.
  
 
</td>
 
</td>
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Insecure web interfaces can result in data loss or corruption, lack of accountability, or denial of access and can lead to complete device takeover.
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Collection of personal data along with a lack of protection of that data can lead to compromise of a user's personal data.
  
 
</td>
 
</td>
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider the business impact of compromised devices and in turn compromised customers. All data could be stolen, modified, or deleted.  Could your users be harmed?
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider the business impact of personal data that is collected unnecessarily or isn't protected properly. Data could be stolen.  Could your customers be harmed by having this personal data exposed?
  
 
</td>
 
</td>
 
{{Top_10_2010:SummaryTableEndTemplate|year=2013}}
 
{{Top_10_2010:SummaryTableEndTemplate|year=2013}}
  
−
{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=1|year=2013|language=en}}
+
{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Does My Device Present Privacy Concerns?|position=firstLeft|year=2013|language=en}}
−
The simplest way to find out if you have an insecure web interface is to review the initial setup process and determine if the username, password or both can be changed and if the password is required to be long and complex.
+
Checking for Privacy Concerns includes:
 +
* Identifying all data types that are being collected by the device, its mobile application and any cloud interfaces
 +
* The device and it's various components should only collect what is necessary to perform its function
 +
* Personally identifiable information can be exposed when not properly encrypted while at rest on storage mediums and during transit over networks
 +
* Reviewing who has access to personal information that is collected
 +
* Determining if data collected can be de-identified or anonymized
 +
* Determining if data collected is beyond what is needed for proper operation of the device (Does the end-user have a choice for this data collection?)
 +
* Determining if a data retention policy is in place
  
−
Attempting to set usernames to simple passwords such as "1234" is a fast and easy way to determine the security of the web interface. Manual testing can help a security analyst find instances where weak passwords are allowed, default credentials are not required to be changed or account enumeration is possible. Penetration testers can validate these issues by running enumerating usernames and conducting brute-force attacks against those usernames.
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Prevent Privacy Concerns?|position=right|year=2013|language=en}}
 +
Minimizing privacy concerns requires:
 +
# Ensuring only data critical to the functionality of the device is collected
 +
# Ensuring that any data collected is of a less sensitive nature (i.e., try not to collect sensitive data)
 +
# Ensuring that any data collected is de-identified or anonymized
 +
# Ensuring any data collected is properly protected with encryption
 +
# Ensuring the device and all of its components properly protect personal information
 +
# Ensuring only authorized individuals have access to collected personal information
 +
# Ensuring that retention limits are set for collected data
 +
# Ensuring that end-users are provided with "Notice and Choice" if data collected is more than what would be expected from the product
 +
# Ensuring the role based access control/authorization to the collected data/analyzed data is applied
 +
# Ensuring that the analyzed data is de-identified
  
−
Automated dynamic scanning which exercises the application will provide insight into whether these issues exist as well.
+
Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=1|year=2013|language=en}}
 
−
Ensuring a secure web interface requires:
 
−
# Default passwords and possibly usernames to be changed during initial setup.
 
−
# Ensuring complex password construction.
 
−
# Ensuring web interface is not susceptible to XSS, SQLi or CSRF.
 
−
# Ensuring credentials are not exposed in internal or external network traffic.
 
 
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
 
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
−
'''Scenario #1:''' The web interface uses easily guessable default usernames and passwords.
+
'''Scenario #1:''' Collection of personal data.
  
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
−
Username = Admin; Password = password
+
Date of birth, home address, phone number, etc.
  
 
</span>{{Top_10_2010:ExampleEndTemplate}}
 
</span>{{Top_10_2010:ExampleEndTemplate}}
−
'''Scenario #2:''' Username and password in the clear over the network.
+
'''Scenario #2:''' Collection of financial and/or health information.
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
−
POST /login.htm HTTP/1.1
+
Credit card data and bank account information.
−
...
 
−
userid=admin&pass=pass
 
  
 
</span>{{Top_10_2010:ExampleEndTemplate}}
 
</span>{{Top_10_2010:ExampleEndTemplate}}
−
In the cases above, the attacker is able to either easily guess the username and password or is able to capture the username and password as it crosses the network.
+
In the cases above, exposure of any of the data examples could lead to identity theft or compromise of accounts.
  
  
Line 53: Line 63:
 
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
 
{{Top_10_2010:SubSubsectionOWASPReferencesTemplate}}
  
−
{{Top_10_2010:SubSubsectionExternalReferencesTemplate}}
+
[https://www.owasp.org/index.php/Top_10_2013-A6-Sensitive_Data_Exposure Top 10 2013-A6-Sensitive Data Exposure]<br>
 +
[https://www.owasp.org/index.php/OWASP_Top_10_Privacy_Risks_Project Top 10 Privacy Risks Project]
 +
 
 +
{{Top_10_2010:SubSubsectionExternalReferencesTemplate}} <br>
 +
[https://www.ftc.gov/tips-advice/business-center/guidance/careful-connections-building-security-internet-things FTC: Careful Connections: Building Security in the Internet of Things]
 +
[https://www.ftc.gov/system/files/documents/reports/federal-trade-commission-staff-report-november-2013-workshop-entitled-internet-things-privacy/150127iotrpt.pdf FTC: Internet of Things, Privacy & Security in a Connected World]

Latest revision as of 13:59, 14 May 2018

Back To The Internet of Things Top 10
Threat Agents Attack Vectors Security Weakness Technical Impacts Business Impacts
Application Specific Exploitability
AVERAGE		 Prevalence
COMMON		 Detectability
EASY		 Impact
SEVERE		 Application / Business Specific
Consider anyone who has access to the device itself, the network the device is connected to, the mobile application and the cloud connection including external and internal users. Attacker uses multiple vectors such as insufficient authentication, lack of transport encryption or insecure network services to view personal data which is not being properly protected or is being collected unnecessarily. Attack could come from external or internal users. Privacy concerns generated by the collection of personal data in addition to the lack of proper protection of that data is prevalent. Privacy concerns are easy to discover by simply reviewing the data that is being collected as the user sets up and activates the device. Automated tools can also look for specific patterns of data that may indicate collection of personal data or other sensitive data. Collection of personal data along with a lack of protection of that data can lead to compromise of a user's personal data. Consider the business impact of personal data that is collected unnecessarily or isn't protected properly. Data could be stolen. Could your customers be harmed by having this personal data exposed?
Does My Device Present Privacy Concerns?

Checking for Privacy Concerns includes:

  • Identifying all data types that are being collected by the device, its mobile application and any cloud interfaces
  • The device and it's various components should only collect what is necessary to perform its function
  • Personally identifiable information can be exposed when not properly encrypted while at rest on storage mediums and during transit over networks
  • Reviewing who has access to personal information that is collected
  • Determining if data collected can be de-identified or anonymized
  • Determining if data collected is beyond what is needed for proper operation of the device (Does the end-user have a choice for this data collection?)
  • Determining if a data retention policy is in place
How Do I Prevent Privacy Concerns?

Minimizing privacy concerns requires:

  1. Ensuring only data critical to the functionality of the device is collected
  2. Ensuring that any data collected is of a less sensitive nature (i.e., try not to collect sensitive data)
  3. Ensuring that any data collected is de-identified or anonymized
  4. Ensuring any data collected is properly protected with encryption
  5. Ensuring the device and all of its components properly protect personal information
  6. Ensuring only authorized individuals have access to collected personal information
  7. Ensuring that retention limits are set for collected data
  8. Ensuring that end-users are provided with "Notice and Choice" if data collected is more than what would be expected from the product
  9. Ensuring the role based access control/authorization to the collected data/analyzed data is applied
  10. Ensuring that the analyzed data is de-identified

Please review the following tabs for more detail based on whether you are a Manufacturer, Developer or Consumer

Example Attack Scenarios

Scenario #1: Collection of personal data.

Date of birth, home address, phone number, etc.

Scenario #2: Collection of financial and/or health information.

Credit card data and bank account information.

In the cases above, exposure of any of the data examples could lead to identity theft or compromise of accounts.


References

OWASP

Top 10 2013-A6-Sensitive Data Exposure
Top 10 Privacy Risks Project

External
FTC: Careful Connections: Building Security in the Internet of Things

FTC: Internet of Things, Privacy & Security in a Connected World
Retrieved from "https://wiki.owasp.org/index.php?title=Top_10_2014-I5_Privacy_Concerns&oldid=240702"