781
Scope Impact Likelihood
Integrity
Confidentiality
Read Application Data
Modify Files or Directories
Anyone can read the information by gaining access to the
channel being used for communication.
Detection Methods
Black Box
Use monitoring tools that examine the software's process as it interacts with the operating
system and the network. This technique is useful in cases when source code is unavailable, if the
software was not developed by you, or if you want to verify that the build phase did not introduce
any new weaknesses. Examples include debuggers that directly attach to the running process;
system-call tracing utilities such as truss (Solaris) and strace (Linux); system activity monitors
such as FileMon, RegMon, Process Monitor, and other Sysinternals utilities (Windows); and
sniffers and protocol analyzers that monitor network traffic. Attach the monitor to the process,
trigger the feature that sends the data, and look for the presence or absence of common
cryptographic functions in the call tree. Monitor the network and determine if the data packets
contain readable commands. Tools exist for detecting if certain encodings are in use. If the traffic
contains high entropy, this might indicate the usage of encryption.
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic
protocols.
Phase: Implementation
When using web applications with SSL, use SSL for the entire session from login to logout, not
just for the initial login page.
Phase: Implementation
When designing hardware platforms, ensure that approved encryption algorithms (such as those
recommended by NIST) protect paths from security critical data to trusted user applications.
Phase: Testing
Use tools and techniques that require manual (human) analysis, such as penetration testing,
threat modeling, and interactive tools that allow the tester to record and modify an active session.
These may be more effective than strictly automated techniques. This is especially the case with
weaknesses that are related to design and business rules.
Phase: Operation
Configure servers to use encrypted channels for communication, which may include SSL or other
secure protocols.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-319: Cleartext Transmission of Sensitive Information
CWE-319: Cleartext Transmission of Sensitive Information