icegov2012 proceedings

include but not limited to: payment of tax, record keeping
(financial records, medical records, intellectual property
information, trade secrets and other citizens’ personal data) etc.
Making some of these services available online presents a better
and easy way of government-citizens’ relationship, most
especially on discharging obligations within and across the
parties. However, the concern now is the fear of adequate
technical capability or awareness of susceptibility of the design of
such platforms (websites) without given cognizance for avoidance
of common programming errors which may jeopardize successful
operation of the websites. A website is said to be vulnerable when
it has the propensity for infiltration which may be as a result of
flaws within the codes that made up the website, this is referred to
application level [4] or server side attacks. Other issues of concern
have to do with some underlying technicalities that can prevent
unforeseen circumstances that may befall the successful operation
of the websites.
It has been reported in literature that dynamic web applications
contain a wide range of input validation vulnerabilities such as
cross site scripting [5][6][7][8][9] and SQL injection
[10][11][12][13][14]. Because of the web popularity relative to
the number of millions of Internet users, the internet has become
prime targets for attackers [15] and today they are motivated by
financial gains rather than just being destructive, Symantec (2007)
as cited in [1]. Attacks against web applications constitute more
than 60% of the total attack attempts observed on the Internet as
showed in a report [16]. Also, in the study carried out by [6] it
was reported that 82% of the e-government websites around the
globe were vulnerable to Cross Site Scripting (XSS) and Structure
Query Language injection (SQLi). It was further discovered in the
study that 90% of European, 85% of Asian, 76% of the North
American and 49% of African government websites are
vulnerable to common web application attacks [6]. Apart from the
specified web application attacks earlier mentioned, denial of
service (DoS), unauthorized access to networks, theft of employee
or customer information, online financial fraud etc are also known
prevalent attacks [1].
Furthermore, SQL injection and cross-site scripting may be used
by attackers to alter back-end tables from databases and to launch
phishing attacks on vulnerable servers. Most website owners fail
to validate their application for common flaws and until now,
there is no study that has provided empirical data on how
vulnerable the Nigerian government websites are. It is in this
context that this research is necessitated in order to create
awareness for the government and its bodies on vulnerability level
of their websites and the need to take necessary action. It also
presents some policy suggestions to safeguard possible
occurrences and to present measures to avert continued
susceptibility.
2.0 WEB APPLICATION SECURITY
Web applications have become fertile ground for cyber attackers,
attempting to penetrate systems and misuse private data. Cenzic, a
web security firm, reported that almost 90% of web-related flaws
were caused by web application vulnerabilities with the three
most common types being: SQL injection, Cross-site Scripting,
and Authentication vulnerabilities. The SAN Institute, a
worldwide security organization, reported cross-site scripting,
SQL injection and cross site forgery as major web vulnerabilities
in 2007 [18]. It was further reported that, XSS is the most
237
dangerous and easily found web application security issue that can
cause varieties of issues which may include defacement of web
sites, insertion of hostile content, phishing attacks and allow
hackers to take over a user’s browser. Details of these attacks
shall be discussed in following sections.
2.1 Cross site scripting (XSS)
Cross site scripting is a vulnerability that allows an attacker to bypass
client-side security mechanisms normally imposed on web
content by the browsers. By finding ways of injecting malicious
scripts, usually in the form of JavaScript, VBScript, ActiveX,
HTML or Flash into a vulnerable application, an attacker may
gain privileges to sensitive page-content of the web pages [19]
Because a browser cannot know if the script should be trusted or
not, it will execute the script in the user context and give attacker
access to cookies or session tokens retained by the browser.
Common attack vectors are search applications which reflect the
search string, and parameters supplied in the URL.
2.2 Structured query language injection
(SQLi)
An SQL injection attack consists of insertion or "injection" of a
SQL query via the input data from the client to the application
without proper filtering of dangerous script characters. A
successful SQL injection exploit can read sensitive data from the
database, modify database data (Insert/Update/Delete), execute
administration operations on the database (such as shutdown the
DBMS), recover the content of a given file existing on the DBMS
file system and, in some cases, issue commands to the operating
system [18][19].
2.3 Cookie manipulation
A cookie is a small piece of information usually created by the
web server and stored in the web browser. Each time the user
access the web server, this data is passed back to the server. The
cookie contains information used by web applications to persist
and pass variables back and forth between the browser and the
web application. Client-side cookies can be persistent i.e. files
stored on the client computer until an expiry date; or session i.e.
files kept in the memory of the client computer until the session is
ended. As a result of the cookie structure and their usage, all data
stored in a client-side cookie could be easily read and
manipulated.
2.4 Unencrypted password
One of the security features employed in a web application is
password. Sensitive data such as credit card numbers, social
security numbers sent into the server without using encrypted
connection such as secure socket layer (SSL), can be intercepted
by hackers. Encrypting the transmission of data makes it difficult
to intercept sensitive information as it travels between two parties.
3.0 METHODOLOGY
The research was carried out on 64 Nigerian e-government
websites randomly selected to determine their common web
security issues. An advanced Google search feature was employed
to elicit websites with a sub-domain of ‘.gov.ng’ and with a ‘php
& html’ extension [6] Google retrieved a number of results but
priority was given to the websites with the highest page rank, this