760
algorithms. They will likely be exposed to attacks that are well-understood by cryptographers.
Reverse engineering techniques are mature. If the algorithm can be compromised if attackers
find out how it works, then it is especially weak. Periodically ensure that the cryptography has not
become obsolete. Some older algorithms, once thought to require a billion years of computing
time, can now be broken in days or hours. This includes MD4, MD5, SHA1, DES, and other
algorithms that were once regarded as strong. [REF-267]
Phase: Architecture and Design
Strategy = Separation of Privilege
Compartmentalize the system to have "safe" areas where trust boundaries can be
unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always
be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate
compartmentalization is built into the system design, and the compartmentalization allows for and
reinforces privilege separation functionality. Architects and designers should rely on the principle
of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Phase: Implementation
Phase: Architecture and Design
When using industry-approved techniques, use them correctly. Don't cut corners by skipping
resource-intensive steps (CWE-325). These steps are often essential for preventing common
attacks.
Phase: Implementation
Strategy = Attack Surface Reduction
Use naming conventions and strong types to make it easier to spot when sensitive data is being
used. When creating structures, objects, or other complex entities, separate the sensitive and
non-sensitive data as much as possible.
Effectiveness = Defense in Depth
This makes it easier to spot places in the code where data is being used that is unencrypted.
Demonstrative Examples
Example 1:
This code writes a user's login information to a cookie so the user does not have to login again
later.
Example Language: PHP (Bad)
function persistLogin($username, $password){
$data = array("username" => $username, "password"=> $password);
setcookie ("userdata", $data);
}
The code stores the user's username and password in plaintext in a cookie on the user's machine.
This exposes the user's login information if their computer is compromised by an attacker. Even
if the user's machine is not compromised, this weakness combined with cross-site scripting
(CWE-79) could allow an attacker to remotely copy the cookie.
Also note this example code also exhibits Plaintext Storage in a Cookie (CWE-315).
Example 2:
The following code attempts to establish a connection, read in a password, then store it to a buffer.
Example Language: C (Bad)
server.sin_family = AF_INET; hp = gethostbyname(argv[1]);
if (hp==NULL) error("Unknown host");
CWE Version 4.14
CWE-311: Missing Encryption of Sensitive Data
CWE-311: Missing Encryption of Sensitive Data