1445
Always consider whether knowledge of your code or design is sufficient to break it. Reverse
engineering is a highly successful discipline, and financially feasible for motivated adversaries.
Black-box techniques are established for binary analysis of executables that use obfuscation,
runtime analysis of proprietary protocols, inferring file formats, and others.
Phase: Architecture and Design
When available, use publicly-vetted algorithms and procedures, as these are more likely to
undergo more extensive security analysis and testing. This is especially the case with encryption
and authentication.
Demonstrative Examples
Example 1:
The design of TCP relies on the secrecy of Initial Sequence Numbers (ISNs), as originally covered
in CVE-1999-0077 [REF-542]. If ISNs can be guessed (due to predictability, CWE-330) or sniffed
(due to lack of encryption during transmission, CWE-312), then an attacker can hijack or spoof
connections. Many TCP implementations have had variations of this problem over the years,
including CVE-2004-0641, CVE-2002-1463, CVE-2001-0751, CVE-2001-0328, CVE-2001-0288,
CVE-2001-0163, CVE-2001-0162, CVE-2000-0916, and CVE-2000-0328.
Observed Examples
Reference Description
CVE-2006-6588 Reliance on hidden form fields in a web application. Many web application
vulnerabilities exist because the developer did not consider that "hidden" form
fields can be processed using a modified client.
https://www.cve.org/CVERecord?id=CVE-2006-6588
CVE-2006-7142 Hard-coded cryptographic key stored in executable program.
https://www.cve.org/CVERecord?id=CVE-2006-7142
CVE-2005-4002 Hard-coded cryptographic key stored in executable program.
https://www.cve.org/CVERecord?id=CVE-2005-4002
CVE-2006-4068 Hard-coded hashed values for username and password contained in clientside
script, allowing brute-force offline attacks.
https://www.cve.org/CVERecord?id=CVE-2006-4068
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 975 SFP Secondary Cluster: Architecture 888 2406
MemberOf 1348 OWASP Top Ten 2021 Category A04:2021 - Insecure
Design
1344 2491
MemberOf 1418 Comprehensive Categorization: Violation of Secure
Design Principles
1400 2549
Notes
Relationship
Note that there is a close relationship between this weakness and CWE-603 (Use of Client-Side
Authentication). If developers do not believe that a user can reverse engineer a client, then they
are more likely to choose client-side authentication in the belief that it is safe.
References
[REF-196]Jerome H. Saltzer and Michael D. Schroeder. "The Protection of Information in Computer
Systems". Proceedings of the IEEE 63. 1975 September. < http://web.mit.edu/Saltzer/www/
publications/protection/ >.
CWE Version 4.14
CWE-657: Violation of Secure Design Principles
CWE-657: Violation of Secure Design Principles