This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Top 10 2014-I10 Poor Physical Security"

From OWASP
Jump to: navigation, search
(Created page with "<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=OWASP_Internet_of_Things_Top_10_for_2014 Back To The Internet of Things Top 10]</center> ...")
 
 
(16 intermediate revisions by the same user not shown)
Line 1: Line 1:
−
<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=OWASP_Internet_of_Things_Top_10_for_2014 Back To The Internet of Things Top 10]</center>
+
<center>[https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project#tab=Top_10_IoT_Vulnerabilities__282014_29 Back To The Internet of Things Top 10]</center>
  
 
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
 
{{Top_10_2010:SummaryTableHeaderBeginTemplate|year=2013|language=en}}
−
{{Top_10:SummaryTableTemplate|exploitability=1|prevalence=2|detectability=2|impact=1|year=2013|language=en}}
+
{{Top_10:SummaryTableTemplate|exploitability=2|prevalence=2|detectability=2|impact=1|year=2013|language=en}}
 
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
 
{{Top_10_2010:SummaryTableHeaderEndTemplate|year=2013}}
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has access to the web interface including external users, internal users, and administrators.
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider anyone who has physical access to the device.
  
 
</td>
 
</td>
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Attacker uses weak default credentials, captures plain-text credentials or enumerates accounts to access the web interface. Depending on setup, attack could come from external or internal users.
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Attacker uses vectors such as USB ports, SD cards or other storage means to access the Operating System and potentially any data stored on the device.
  
 
</td>
 
</td>
−
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>An insecure web interface is present when easy to guess or well known default credentials are used. Insecure web interfaces are prevalent as manufacturers strive to make interfaces easier for users to use and assume these interfaces will not be exposed to external users. They are often found in devices which have features that can only be accessed via the web interface. Issues with the web interface are easy to discover when examining the interface manually and frequently easy to discover via automated testing.
+
     <td colspan=2  {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Physical security weaknesses are present when an attacker can disassemble a device to easily access the storage medium and any data stored on that medium. Weaknesses are also present when USB ports or other external ports can be used to access the device using features intended for configuration or maintenance.
  
 
</td>
 
</td>
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Insecure web interfaces can result in data loss or corruption, lack of accountability, or denial of access and can lead to complete device takeover.
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Insufficient physical security could lead to compromise of the device itself and any data stored on that device.
  
 
</td>
 
</td>
−
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Consider the business impact of compromised devices and in turn compromised customers. All data could be stolen, modified, or deleted. Could your users be harmed?
+
     <td {{Template:Top 10 2010:SummaryTableRowStyleTemplate|year=2013}}>Data could be stolen or modified and the device taken control of for purposes other than what was originally intended. Could your customers be harmed? Could your brand be harmed?
  
 
</td>
 
</td>
 
{{Top_10_2010:SummaryTableEndTemplate|year=2013}}
 
{{Top_10_2010:SummaryTableEndTemplate|year=2013}}
  
−
{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=vulnerableTo|position=firstLeft|risk=1|year=2013|language=en}}
+
{{Top_10:SubsectionTableBeginTemplate|type=main}} {{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=Is My Physical Security Sufficient?|position=firstLeft|year=2013|language=en}}
−
The simplest way to find out if you have an insecure web interface is to review the initial setup process and determine if the username, password or both can be changed and if the password is required to be long and complex.
+
Checking for Poor Physical Security includes:
 +
* Reviewing how easily a device can be disassembled and data storage mediums accessed or removed
 +
* Reviewing the use of external ports such as USB to determine if data can be accessed on the device without disassembling the device.
 +
* Reviewing the number of physical external ports to determine if all are required for proper device function
 +
* Reviewing the administrative interface to determine if external ports such as USB can be deactivated
 +
* Reviewing the administrative interface to determine if administrative capabilities can be limited to local access only
  
−
Attempting to set usernames to simple passwords such as "1234" is a fast and easy way to determine the security of the web interface. Manual testing can help a security analyst find instances where weak passwords are allowed, default credentials are not required to be changed or account enumeration is possible. Penetration testers can validate these issues by running enumerating usernames and conducting brute-force attacks against those usernames.
+
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=freetext|title=How Do I Physically Secure My Device?|position=right|year=2013|language=en}}
 +
Adequate physical security requires:
 +
# Ensuring data storage medium can not be easily removed.
 +
# Ensuring stored data is encrypted at rest.
 +
# Ensuring USB ports or other external ports can not be used to maliciously access the device.
 +
# Ensuring device can not be easily disassembled.
 +
# Ensuring only required external ports such as USB are required for the product to funtion
 +
# Ensuring the product has the ability to limit administrative capabilities
 +
 
 +
Please review the following tabs for more detail based on whether you are a [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Manufacturers Manufacturer], [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Developers Developer] or [https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project#tab=Consumers Consumer]
  
−
Automated dynamic scanning which exercises the application will provide insight into whether these issues exist as well.
 
−
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=howPrevent|position=right|risk=1|year=2013|language=en}}
 
−
Ensuring a secure web interface requires:
 
−
# Default passwords and possibly usernames to be changed during initial setup.
 
−
# Ensuring complex password construction.
 
−
# Ensuring web interface is not susceptible to XSS, SQLi or CSRF.
 
−
# Ensuring credentials are not exposed in internal or external network traffic.
 
 
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
 
{{Top_10_2010:SubsectionAdvancedTemplate|type={{Top_10_2010:StyleTemplate}}|subsection=example|position=left|risk=1|year=2013|language=en}}
−
'''Scenario #1:''' The web interface uses easily guessable default usernames and passwords.
+
'''Scenario #1:''' The device can be easily disassembled and storage medium is an unencrypted SD card.
  
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
−
Username = Admin; Password = password
+
SD card can be removed and inserted into a card reader to be modified or copied.
  
 
</span>{{Top_10_2010:ExampleEndTemplate}}
 
</span>{{Top_10_2010:ExampleEndTemplate}}
−
'''Scenario #2:''' Username and password in the clear over the network.
+
'''Scenario #2:''' USB ports are present on the device.
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
 
{{Top_10_2010:ExampleBeginTemplate|year=2013}}<span style="color:red;">
−
POST /login.htm HTTP/1.1
+
Custom software could be written to take advantage of features such as updating via the USB port to modify the original device software.
−
...
 
−
userid=admin&pass=pass
 
  
 
</span>{{Top_10_2010:ExampleEndTemplate}}
 
</span>{{Top_10_2010:ExampleEndTemplate}}
−
In the cases above, the attacker is able to either easily guess the username and password or is able to capture the username and password as it crosses the network.
+
In both cases, an attacker is able to access the original device software and make modifications or simply copy specific target data.
  
  

Latest revision as of 23:03, 1 December 2015

Back To The Internet of Things Top 10
Threat Agents Attack Vectors Security Weakness Technical Impacts Business Impacts
Application Specific Exploitability
AVERAGE		 Prevalence
COMMON		 Detectability
AVERAGE		 Impact
SEVERE		 Application / Business Specific
Consider anyone who has physical access to the device. Attacker uses vectors such as USB ports, SD cards or other storage means to access the Operating System and potentially any data stored on the device. Physical security weaknesses are present when an attacker can disassemble a device to easily access the storage medium and any data stored on that medium. Weaknesses are also present when USB ports or other external ports can be used to access the device using features intended for configuration or maintenance. Insufficient physical security could lead to compromise of the device itself and any data stored on that device. Data could be stolen or modified and the device taken control of for purposes other than what was originally intended. Could your customers be harmed? Could your brand be harmed?
Is My Physical Security Sufficient?

Checking for Poor Physical Security includes:

  • Reviewing how easily a device can be disassembled and data storage mediums accessed or removed
  • Reviewing the use of external ports such as USB to determine if data can be accessed on the device without disassembling the device.
  • Reviewing the number of physical external ports to determine if all are required for proper device function
  • Reviewing the administrative interface to determine if external ports such as USB can be deactivated
  • Reviewing the administrative interface to determine if administrative capabilities can be limited to local access only
How Do I Physically Secure My Device?

Adequate physical security requires:

  1. Ensuring data storage medium can not be easily removed.
  2. Ensuring stored data is encrypted at rest.
  3. Ensuring USB ports or other external ports can not be used to maliciously access the device.
  4. Ensuring device can not be easily disassembled.
  5. Ensuring only required external ports such as USB are required for the product to funtion
  6. Ensuring the product has the ability to limit administrative capabilities

Please review the following tabs for more detail based on whether you are a Manufacturer, Developer or Consumer

Example Attack Scenarios

Scenario #1: The device can be easily disassembled and storage medium is an unencrypted SD card.

SD card can be removed and inserted into a card reader to be modified or copied.

Scenario #2: USB ports are present on the device.

Custom software could be written to take advantage of features such as updating via the USB port to modify the original device software.

In both cases, an attacker is able to access the original device software and make modifications or simply copy specific target data.


References

OWASP

External
Retrieved from "https://wiki.owasp.org/index.php?title=Top_10_2014-I10_Poor_Physical_Security&oldid=204223"