ttern - Free Web Hosting with PHP, MySQL and cPanel

The Logic Behind Application Logic Defects
appropriate logic controls to identify that the player has
already used their turn, can be manipulated, and in fact,
has been in the past.
Picking on Parallel Processes
Turning a developer’s time-optimization technique against
the application is also a great way to exploit application
logic defects. Developers are often trying to speed their
applications and optimize workflow to accomplish multiple
tasks concurrently. An attacker can exploit this type of
optimization by looking for what appear to be parallel
processes that should logically run in serial.
A good example is a business with an online shopping
cart that has also implemented a customer loyalty
system. Once a customer logs in and places their order,
their purchases are converted to points which can be
redeemed for goods or services at a later date. A hacker
can attempt to manipulate this system by placing a small
order, then entering an incorrect payment method to
ensure that the transaction fails. Often, the loyalty points
transaction and payment transaction are conducted in
parallel for speed. However, even though the payment
transaction fails, the loyalty points are still added to the
customer’s account. This type of attack can be repeated,
or even scripted, to obtain a large volume of loyalty points
while not spending any money with the vendor.
Exploiting Numerical Handling Vulnerabilities
It’s important to validate that an application handles
various numeric inputs correctly. Once again, turning to
a shopping cart feature, if a hacker can input a negative
number into an order system various issues can arise,
including something called phantom inventory. If the
application allows a negative number to be used, a
hacker can simply add inventory that doesn’t exist
during the purchase or acquisition process.
For example, a recently discovered and patched
issue in a popular Internet application allowed clientside
validation of input, but if the hacker stripped out
the field validation, which was written in JavaScript, or
intercepted and manipulated the request, a negative
number could be inserted. Inside the application logic
there were immediately two issues. First, someone
could checkout with a negative number prompting a
debit to their account or credit card. This in effect was
stealing money from the vendor. The second issue was
with the back-end inventory management system which
now reflected a discrepancy in available stock.
The Devil is in the Details
Logic defects in an application can cause serious
business challenges. Discovering these types of
issues takes time, and isn’t a simple matter of coding
up a scanner tool. Each issue has a unique method of
discovery, is different from one application to another,
and is often different from one developer to another.
The one thing all logic defects have in common is they
are virtually invisible to modern web attack mitigation
platforms. Whether there is a web application firewall,
an intrusion prevention system, or any combination
thereof – it’s nearly certain that attacking web application
logic will be invisible to the victim –whether that it be an
enterprise, a small business, or a governmental entity.
This is primarily due to the lack of identifiable patterns
such as tell-tale SQL Injection markers. Requests and
responses are often legitimate, and don’t trigger an
alarm or raise suspicion even if the hack is successful.
Remaining undetected makes this type of attack very
attractive to hackers, fraudsters, and others.
Additionally, these types of security defects in applications
often slip past testing teams as scanning tools and formal
logic testing methodologies are still maturing. The best
weapon against these types of security defects is the
Quality Assurance testing organization at each business.
QA testers are well-versed in application logic for the
purposes of functional testing. Rather than developing logic
testing methodology from scratch, security testing teams
should collaborate with their QA organizations to add logic
testing into their already well-adopted methodologies.
It Takes a Village
Logic defects are difficult to avoid in code, difficult to
effectively test for, and nearly impossible to detect. As
hackers exhaust obvious and scriptable defects on the
Internet, web-based applications will likely be their next
attack vector. Rather than waiting for the deluge of
attacks, and for the appearance of scathing headlines,
now is the time for development organizations,
application security teams, and businesses to work
together to fortify their web-based applications against
these attacks. Focus on discussing this with your QA
organization, develop an internal testing methodology
that suits the applications you build, and test your
existing applications. You can then apply these lessons
learned to new applications you design before they are
deployed throughout the organization.
RAFAL LOS
Rafal Los Enterprise and Cloud Security Strategist for Hewlett-
Packard Software, combines over a decade of deep technical
expertise in information security and risk management with
a critical business perspective. From technical research to
building and implementing enterprise application security
programs, Rafal has a proven track record with organizations
of diverse sizes and verticals.
Prior to joining HP, Los de�ned the framework for a software
security program and served as a security lead at a Global
Fortune 100. Los also contributed to the global organization’s
security and risk-management strategy internally and with
their customers.
www.hakin9.org/en 21