VRT Addition - Hardware and Physical Security #408
Assignees
Comments
|
Adding VRT Priorities below, please note, most are marked as Varies, as they are heavily context dependent for the target, the environmental context, and the access requirements.
|
|
Adding CVSS data and remediation advice. CVSS {
"id": "physical_security_issues",
"children": [
{
"id": "weakness_in_physical_access_control",
"children": [
{
"id": "cloneable_key",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
},
{
"id": "commonly_keyed_system",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
},
{
"id": "master_key_identification",
"cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
}
],
"id": "bypass_of_physical_access_control",
"cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
}
]
},
}
"id": "insecure_os_firmware",
"children": [
{
"id": "command_injection",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"id": "data_not_encrypted_at_rest",
"children": [
{
"id": "non_sensitive",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"id": "sensitive",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
]
}
{
"id": "failure_to_remove_sensitive_artifacts_from_disk",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"id": "hardcoded_password",
"children": [
{
"id": "non_privileged_user",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"id": "privileged_user",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
]
}
{
"id": "kiosk_escape",
"cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
},
{
"id": "local_administrator_on_default_environment",
"cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
{
"id": "overpermissioned_credentials_on_storage",
"cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"id": "poorly_configured_disk_encryption",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"id": "poorly_configured_operating_system_security",
"cvss_v3": "AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
},
{
"id": "recovery_of_disk_contains_sensitive_material",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"id": "shared_credentials_on_storage",
"cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"id": "weakness_in_firmware_updates",
"children": [
{
"id": "firmware_cannot_be_updated",
"cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
},
{
"id": "firmware_does_not_validate_update_integrity",
"cvss_v3": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
}
{
"id": "firmware_is_not_encrypted",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
]
}
]
}
}
Remediation {
"id": "physical_security_issues",
"children": [
{
"id": "weakness_in_physical_access_control",
"children": [
{
"id": "cloneable_key",
"remediation_advice": "The 2 most effective are interative locking elements (which can be defeated still by a skilled attacker) or usage of digital key systems such as Assa eCLIQ or Pulse"
},
{
"id": "commonly_keyed_system",
"remediation_advice": "Unique keys should be used on any system which intends to be secure, otherwise if keyed to a common key system, the risk needs to be accepted that the key could be obtained if the lock doesn't secure a secure component."
},
{
"id": "master_key_identification",
"remediation_advice": "While physical lock systems require the key material to be inside the lock, electonic access control systems can use cryptographicly strong key mechanisms which prevent the key material from being accessable on the device"
}
],
"id": "bypass_of_physical_access_control",
"remediation_advice": ""
}
]
},
}
"id": "insecure_os_firmware",
"children": [
{
"id": "command_injection",
"remediation_advice": "1. Avoid using shell execution functions. If unavoidable, limit their use to very specific use cases.\n2. Perform proper input validation when taking user input into a shell execution command.\n3. Use a safe API when accepting user input into the application.\n4. Escape special characters in the case where a safe API is not available.",
"references": [
"https://www.owasp.org/index.php/Top_10-2017_A1-Injection",
"https://www.owasp.org/index.php/Command_Injection",
"http://projects.webappsec.org/OS-Commanding",
"https://www.owasp.org/index.php/Injection_Prevention_Cheat_Sheet",
"https://www.cvedetails.com/vulnerability-list/opec-1/execute-code.html"
]
},
{
"id": "data_not_encrypted_at_rest",
"children": [
{
"id": "non_sensitive",
"remediation_advice": "Data within the device should be encrypted at rest, preventing the data from being viewable by a 3rd party attacker."
},
{
"id": "sensitive",
"remediation_advice": "Data within the device should be encrypted at rest, preventing the data from being viewable by a 3rd party attacker."
}
]
}
{
"id": "failure_to_remove_sensitive_artifacts_from_disk",
"remediation_advice": "Implement robust deletion functions which not only reference to the data, but write over the existing data to prevent digital forensic methods of recovery"
},
{
"id": "hardcoded_password",
"remediation_advice": "1. Never use a hardcoded password within the source code. Many times, the application can be disassembled or decompiled after it has been compiled. This will likely reveal the hardcoded password string to an attacker.\n2. Never use a password string. Instead, use a random salt per user with the password string and run it through a cryptographically strong hashing algorithm.\n3. Store the salt and the hashed password server-side and do the check there. Never check the password on the client side.",
"references": [
"https://www.owasp.org/index.php/Password_Management:_Hardcoded_Password",
"https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"
]
}
{
"id": "kiosk_escape",
"remediation_advice": "1. Implement vigirous QA testing of applications prior to deployment\n2. Implement robust error logging and catching within the application to prevent crashes\n3. Initiate application restarts in the event of a application crash.\n4. Use Lower Privleged accounts with minimal permissions to lower the impact of a potential kiosk escape"
},
{
"id": "local_administrator_on_default_environment",
"remediation_advice": "The usage of Local Administrator accounts on a device is usually not nessicary for the operation, especially with embedded hardware and kiosks. Use of Lower Privleged accounts with minimal permissions and Jails lowers the impact if access by an attacker is acheved."
},
{
"id": "overpermissioned_credentials_on_storage",
"remediation_advice": "When provisioning credentials, strict scoping of the credentials to the resources required to operate reduce the impact of an exposure of those credentials."
},
{
"id": "poorly_configured_disk_encryption",
"remediation_advice": "1. Use of standard cryptographic libraries reduces the likelyhood of implementation vulnerabilities\n2. Verify your bootloader and encryption systems are up to date to avoid public exploits."
},
{
"id": "poorly_configured_operating_system_security",
"remediation_advice": "Following standards such as the NIST or ASD hardening guide allows you to identify known configuration issues and apply configuration changes to prevent this from being exploited further."
},
{
"id": "recovery_of_disk_contains_sensitive_material",
"remediation_advice": "Implement robust deletion functions which not only reference to the data, but write over the existing data to prevent digital forensic methods of recovery."
},
{
"id": "shared_credentials_on_storage",
"remediation_advice": "Credentials for shared services should be avoided where possible, they allow for a single breach to be escalated to effect an entire organisation. When provisioning a service credential, they should be unique per device and strict scoped to the resources required to operate, to reduce the impact of an exposure of those credentials"
},
{
"id": "weakness_in_firmware_updates",
"children": [
{
"id": "firmware_cannot_be_updated",
"remediation_advice": "Implement the ability for the firmware to be upgraded on a device, including an automatic update policy, which will allow for the patch of future security issues on the device."
},
{
"id": "firmware_does_not_validate_update_integrity",
"remediation_advice": "Implementation of firmware integrity checking using cryptographic signitures of a certificate is considered best practice, allowing the integrity of the firmware updates to be validated by the device prior to patching."
}
{
"id": "firmware_is_not_encrypted",
"remediation_advice": "Implementation of encryption for firmware updates allows for the update data to be protected during transit, and increases the time taken to reverse engineer the firmware used, and future security patches."
}
]
}
]
}
}
|
|
OMG wow this is a lot of information for me to understand out once if there
is any way I can be contacted virtually or by phone to help me understand
all of this because I am a person with disabilities and wow this is a lot
of information and I am having a hard time understanding it all please
contact me during the day at this time I am falling asleep due to vacation
at 1:30 in the morning
…On Fri, Mar 15, 2024, 1:04 AM Adam Jon Foster ***@***.***> wrote:
Adding CVSS data and remediation advice.
CVSS
{
"id": "physical_security_issues",
"children": [
{
"id": "weakness_in_physical_access_control",
"children": [
{
"id": "cloneable_key",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"
},
{
"id": "commonly_keyed_system",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N"
},
{
"id": "master_key_identification",
"cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
}
],
"id": "bypass_of_physical_access_control",
"cvss_v3": "AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
}
]
},
}
"id": "insecure_os_firmware",
"children": [
{
"id": "command_injection",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"id": "data_not_encrypted_at_rest",
"children": [
{
"id": "non_sensitive",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"id": "sensitive",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
]
}
{
"id": "failure_to_remove_sensitive_artifacts_from_disk",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
},
{
"id": "hardcoded_password",
"children": [
{
"id": "non_privileged_user",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L"
},
{
"id": "privileged_user",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
]
}
{
"id": "kiosk_escape",
"cvss_v3": "AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"
},
{
"id": "local_administrator_on_default_environment",
"cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
},
{
"id": "overpermissioned_credentials_on_storage",
"cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"id": "poorly_configured_disk_encryption",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"id": "poorly_configured_operating_system_security",
"cvss_v3": "AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L"
},
{
"id": "recovery_of_disk_contains_sensitive_material",
"cvss_v3": "AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"id": "shared_credentials_on_storage",
"cvss_v3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
},
{
"id": "weakness_in_firmware_updates",
"children": [
{
"id": "firmware_cannot_be_updated",
"cvss_v3": "AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L"
},
{
"id": "firmware_does_not_validate_update_integrity",
"cvss_v3": "AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H"
}
{
"id": "firmware_is_not_encrypted",
"cvss_v3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
]
}
]
}
}
Remediation
{
"id": "physical_security_issues",
"children": [
{
"id": "weakness_in_physical_access_control",
"children": [
{
"id": "cloneable_key",
"remediation_advice": "The 2 most effective are interative locking elements (which can be defeated still by a skilled attacker) or usage of digital key systems such as Assa eCLIQ or Pulse"
},
{
"id": "commonly_keyed_system",
"remediation_advice": "Unique keys should be used on any system which intends to be secure, otherwise if keyed to a common key system, the risk needs to be accepted that the key could be obtained if the lock doesn't secure a secure component."
},
{
"id": "master_key_identification",
"remediation_advice": "While physical lock systems require the key material to be inside the lock, electonic access control systems can use cryptographicly strong key mechanisms which prevent the key material from being accessable on the device"
}
],
"id": "bypass_of_physical_access_control",
"remediation_advice": ""
}
]
},
}
"id": "insecure_os_firmware",
"children": [
{
"id": "command_injection",
"remediation_advice": "1. Avoid using shell execution functions. If unavoidable, limit their use to very specific use cases.\n2. Perform proper input validation when taking user input into a shell execution command.\n3. Use a safe API when accepting user input into the application.\n4. Escape special characters in the case where a safe API is not available.",
"references": [
"https://www.owasp.org/index.php/Top_10-2017_A1-Injection",
"https://www.owasp.org/index.php/Command_Injection",
"http://projects.webappsec.org/OS-Commanding",
"https://www.owasp.org/index.php/Injection_Prevention_Cheat_Sheet",
"https://www.cvedetails.com/vulnerability-list/opec-1/execute-code.html"
]
},
{
"id": "data_not_encrypted_at_rest",
"children": [
{
"id": "non_sensitive",
"remediation_advice": "Data within the device should be encrypted at rest, preventing the data from being viewable by a 3rd party attacker."
},
{
"id": "sensitive",
"remediation_advice": "Data within the device should be encrypted at rest, preventing the data from being viewable by a 3rd party attacker."
}
]
}
{
"id": "failure_to_remove_sensitive_artifacts_from_disk",
"remediation_advice": "Implement robust deletion functions which not only reference to the data, but write over the existing data to prevent digital forensic methods of recovery"
},
{
"id": "hardcoded_password",
"remediation_advice": "1. Never use a hardcoded password within the source code. Many times, the application can be disassembled or decompiled after it has been compiled. This will likely reveal the hardcoded password string to an attacker.\n2. Never use a password string. Instead, use a random salt per user with the password string and run it through a cryptographically strong hashing algorithm.\n3. Store the salt and the hashed password server-side and do the check there. Never check the password on the client side.",
"references": [
"https://www.owasp.org/index.php/Password_Management:_Hardcoded_Password",
"https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md"
]
}
{
"id": "kiosk_escape",
"remediation_advice": "1. Implement vigirous QA testing of applications prior to deployment\n2. Implement robust error logging and catching within the application to prevent crashes\n3. Initiate application restarts in the event of a application crash.\n4. Use Lower Privleged accounts with minimal permissions to lower the impact of a potential kiosk escape"
},
{
"id": "local_administrator_on_default_environment",
"remediation_advice": "The usage of Local Administrator accounts on a device is usually not nessicary for the operation, especially with embedded hardware and kiosks. Use of Lower Privleged accounts with minimal permissions and Jails lowers the impact if access by an attacker is acheved."
},
{
"id": "overpermissioned_credentials_on_storage",
"remediation_advice": "When provisioning credentials, strict scoping of the credentials to the resources required to operate reduce the impact of an exposure of those credentials."
},
{
"id": "poorly_configured_disk_encryption",
"remediation_advice": "1. Use of standard cryptographic libraries reduces the likelyhood of implementation vulnerabilities\n2. Verify your bootloader and encryption systems are up to date to avoid public exploits."
},
{
"id": "poorly_configured_operating_system_security",
"remediation_advice": "Following standards such as the NIST or ASD hardening guide allows you to identify known configuration issues and apply configuration changes to prevent this from being exploited further."
},
{
"id": "recovery_of_disk_contains_sensitive_material",
"remediation_advice": "Implement robust deletion functions which not only reference to the data, but write over the existing data to prevent digital forensic methods of recovery."
},
{
"id": "shared_credentials_on_storage",
"remediation_advice": "Credentials for shared services should be avoided where possible, they allow for a single breach to be escalated to effect an entire organisation. When provisioning a service credential, they should be unique per device and strict scoped to the resources required to operate, to reduce the impact of an exposure of those credentials"
},
{
"id": "weakness_in_firmware_updates",
"children": [
{
"id": "firmware_cannot_be_updated",
"remediation_advice": "Implement the ability for the firmware to be upgraded on a device, including an automatic update policy, which will allow for the patch of future security issues on the device."
},
{
"id": "firmware_does_not_validate_update_integrity",
"remediation_advice": "Implementation of firmware integrity checking using cryptographic signitures of a certificate is considered best practice, allowing the integrity of the firmware updates to be validated by the device prior to patching."
}
{
"id": "firmware_is_not_encrypted",
"remediation_advice": "Implementation of encryption for firmware updates allows for the update data to be protected during transit, and increases the time taken to reverse engineer the firmware used, and future security patches."
}
]
}
]
}
}
—
Reply to this email directly, view it on GitHub
<#408 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/BEGMDPCYO4RG5HMOIWSE7BTYYKFPJAVCNFSM6AAAAABERWZODOVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTSOJYHE4TSNRZG4>
.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***
com>
|
|
Hey @1keep2keepFaith, Regarding the changes, this should break it down for you, happy to answer any questions if you need.
|
|
Associated Templates have been added to the bugcrowd/templates project, listing below Additional Insecure OS/Firmware PR |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
and others
Description
The Bugcrowd VRT holds a lot of information regarding Web application and Car hacking related issues, however not a lot regarding physical hardware, which has become a popular topic for our incoming bashes and clients. We've identified a few holes within the existing VRT to fill in, and we're looking for responses prior to merging it into the primary repo.
Changes
Removals from Existing VRT
Insecure Data Storage Sensitive Application Data Stored Unencrypted On Internal Storage
Insecure Data Storage Non-Sensitive Application Data Stored Unencrypted
Addition to the VRT
Physical Security issues
Physical Security issues.Bypass of physical access control
Physical Security issues.Weakness in physical access control
Physical Security issues.Weakness in physical access control.Cloneable Key
Physical Security issues.Weakness in physical access control.Master Key Identification
Physical Security issues.Weakness in physical access control.Commonly Keyed System
Insecure OS/Firmware.Weakness in Firmware Updates.Firmware cannot be updated
Insecure OS/Firmware.Weakness in Firmware Updates.Firmware does not validate updates integrity
Insecure OS/Firmware.Weakness in Firmware Updates.Firmware is not encrypted
Insecure OS/Firmware.Hardcoded Password.Privileged User
Insecure OS/Firmware.Hardcoded Password.Non-Privileged User
Insecure OS/Firmware.Command Injection
Insecure OS/Firmware.Kiosk Escape or Breakout
Insecure OS/Firmware.Poorly Configured Disk Encryption
Insecure OS/Firmware.Shared Credentials on Storage
Insecure OS/Firmware.Over-Permissioned Credentials on Storage
Insecure OS/Firmware.Local Administrator on default environment
Insecure OS/Firmware.Poorly Configured Operating System Security
Insecure OS/Firmware.Recovery of Disk Contains Sensitive Material
Insecure OS/Firmware.Failure to Remove Sensitive Artefacts from Disk
Insecure OS/Firmware.Data not encrypted at rest.sensitive
Insecure OS/Firmware.Data not encrypted at rest.non sensitive
Notes
Please note, we have not assigned priorities as of yet for these issues, however these will be added to this issue soon.
The text was updated successfully, but these errors were encountered: