Companies today rely heavily on web applications for conducting their business. From online banking sites to ecommerce stores, web applications serve three major purposes:
1. Sensitive Personal & Financial Information
2. Corporate Workflows & Internal Communication
3. Customer Service
Because web applications are available on the Internet, attackers will view them as an easy means of obtaining large quantities of sensitive information. Even well-protected applications can have security holes if the web application exposes certain data, logic, or permissions.
Examples of Incidents That Have Involved This Type of Exploit:
1. Equifax Data Breach (2017)
Attackers took advantage of a vulnerability that existed within a web application framework. The attackers gained access to over 147 million records that contained social security numbers and credit information.
2. Yahoo Data Breach (2013 - 2014)
There were vulnerabilities in Yahoo's web interfaces that allowed attackers to collect user IDs and hashed passwords, which allowed them to gain access to the entire Yahoo user database over time. This compromised millions of Yahoo user accounts and affected billions of Yahoo users.
3. British Airways Data Breach (2018)
Hackers injected malicious code into the booking web application for British Airways, which allowed them to capture credit card information and personal information for over 380,000 British Airways customers.
These incidents exemplify that public-facing web applications are attractive targets for attackers because they are of high value and also easily accessible on the Internet.
Why Web App Attackers Do NOT Need to Worry About Losing Access to the Internet?
1. Attackers have 24/7 access to web applications. No physical access is required.
2. Web applications hold sensitive or valuable information (payment information, usernames and passwords, etc.).
3. The complexity of business processes makes them more difficult to secure.
4. Rapidly developed web applications have greater potential for mistakes that can create security vulnerabilities.
5. Because web applications connect with other systems through APIs, attackers can exploit vulnerabilities within those APIs to gain access to other systems indirectly.
The bottom line is: web applications provide attackers access into an organization’s sensitive information and will continue to do so for some time to come.
Common Types of Attacks Against Web Applications
1. Credential stuffing and brute force – Using automated login attempts with credentials obtained from publicly available databases
2. SQL injection / input abuse – Altering the contents of input fields in order to manipulate database records.
3. Cross-site scripting (XSS) – Inserting malicious scripts into websites with the intent to steal users' session cookies or otherwise manipulate them into performing unauthorized actions.
4. Misconfigured APIs – Not requiring proper authentication for potentially sensitive data being exposed to third parties.
Guidelines to Reduce Risk
1. Update and Patch on a Regular Basis - Even a small update to your web application can deter a large exploit.
2. Have Multi-Factor Authentication (MFA) - MFA will help prevent users from using stolen credentials to access their accounts.
3. Perform Security Testing - Perform both automated scans as well as manual penetration testing of your web applications on a regular basis.
4. Monitor for Unusual or Suspicious Activity - Monitor for abnormal logins, high numbers of API calls, and abnormal behavior (errors).
5. Limit Access/Permissions - Adhere to the principle of least privilege, as this will reduce your organization's exposure to risk.
Free or Low-Cost Tools for Awareness/Testing
1. OWASP ZAP - An open source web application vulnerability scanner.
2. Mozilla Observatory - Analyzes security settings like security headers.
3. Have I Been Pwned? - A way to monitor if any of your credentials have been compromised.
Takeaways
1. Web applications remain the most targeted systems because of the combination of being easily accessible and containing valuable data.
2. Attackers will typically leverage logic flaws, misconfigurations, and weak credentials to gain access to a web application; attackers use malware to attack web applications but it is generally the least-used method of entry and far less effective than exploiting logic flaws and misconfigurations.
3. Preventing web application attacks requires a combination of good security practices, ongoing monitoring, and continual testing.
4. A single oversight or missed step when a web application is used to store or process sensitive data can lead to significant financial loss.
