1692
Technology : ICS/OT (Prevalence = Often)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
If hard-coded passwords are used, it is almost certain that
malicious users will gain access to the account in question.
Integrity
Confidentiality
Availability
Access Control
Other
Read Application Data
Gain Privileges or Assume Identity
Execute Unauthorized Code or Commands
Other
This weakness can lead to the exposure of resources
or functionality to unintended actors, possibly providing
attackers with sensitive information or even execute
arbitrary code.
Detection Methods
Black Box
Credential storage in configuration files is findable using black box methods, but the use of hardcoded
credentials for an incoming authentication routine typically involves an account that is not
visible outside of the code.
Effectiveness = Moderate
Automated Static Analysis
Automated white box techniques have been published for detecting hard-coded credentials for
incoming authentication, but there is some expert disagreement regarding their effectiveness and
applicability to a broad range of methods.
Manual Static Analysis
This weakness may be detectable using manual code analysis. Unless authentication is
decentralized and applied throughout the product, there can be sufficient time for the analyst to
find incoming authentication routines and examine the program logic looking for usage of hardcoded
credentials. Configuration files could also be analyzed.
Manual Dynamic Analysis
For hard-coded credentials in incoming authentication: use monitoring tools that examine the
product's process as it interacts with the operating system and the network. This technique
is useful in cases when source code is unavailable, if the product was not developed by you,
or if you want to verify that the build phase did not introduce any new weaknesses. Examples
include debuggers that directly attach to the running process; system-call tracing utilities such as
truss (Solaris) and strace (Linux); system activity monitors such as FileMon, RegMon, Process
Monitor, and other Sysinternals utilities (Windows); and sniffers and protocol analyzers that
monitor network traffic. Attach the monitor to the process and perform a login. Using call trees or
similar artifacts from the output, examine the associated behaviors and see if any of them appear
to be comparing the input to a fixed string or value.
Automated Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Bytecode Weakness Analysis - including disassembler + source code weakness
analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
Effectiveness = SOAR Partial
CWE Version 4.14
CWE-798: Use of Hard-coded Credentials
CWE-798: Use of Hard-coded Credentials