758
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
If the application does not use a secure channel, such as
SSL, to exchange sensitive information, it is possible for an
attacker with access to the network traffic to sniff packets
from the connection and uncover the data. This attack is
not technically difficult, but does require physical access to
some portion of the network over which the sensitive data
travels. This access is usually somewhere near where the
user is connected to the network (such as a colleague on
the company network) but can be anywhere along the path
from the user to the end server.
Confidentiality
Integrity
Modify Application Data
Omitting the use of encryption in any program which
transfers data over a network of any kind should be
considered on par with delivering the data sent to each
user on the local networks of both the sender and receiver.
Worse, this omission allows for the injection of data into
a stream of communication between two parties -- with
no means for the victims to separate valid data from
invalid. In this day of widespread network attacks and
password collection sniffers, it is an unnecessary risk to
omit encryption from the design of any system which might
benefit from it.
Detection Methods
Manual Analysis
The characterizaton of sensitive data often requires domain-specific understanding, so manual
methods are useful. However, manual efforts might not achieve desired code coverage
within limited time constraints. Black box methods may produce artifacts (e.g. stored data or
unencrypted network transfer) that require manual evaluation.
Effectiveness = High
Automated Analysis
Automated measurement of the entropy of an input/output source may indicate the use or lack of
encryption, but human analysis is still required to distinguish intentionally-unencrypted data (e.g.
metadata) from sensitive data.
Manual Static Analysis - Binary or Bytecode
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities &
anomalies
Effectiveness = SOAR Partial
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful: Cost effective for partial
coverage: Web Application Scanner Web Services Scanner Database Scanners
CWE Version 4.14
CWE-311: Missing Encryption of Sensitive Data
CWE-311: Missing Encryption of Sensitive Data