Original subtitles

0 Hello everyone. 1

So let's continue to the third vulnerability of OWASP that is sensitive data exposure. 2

So what is SDE when any application or API do not protect sensitive data properly like for example 3

user Account details, Credit card details or Passwords etc. Then SDE Vulnerability arises. 4

Also if an attacker can view this sensitive data and get access to the internal network also git hub 5

tokens and API keys which had been leaked on to the Internet can also lead to sensitive data exposure. 6

A very good example to this is a Snapchat report which was submitted by a security researcher on Hackerone 7

wherein he was able to find out a token which was indexed by Google and that token was into GitHub. 8

So he reported that token and he got 15,000$ of bounty basically reward for that specific 9

bug. 10

So SDE can be very critical and dangerous also sensitive invoices which are indexed by Google. 11

There was again a vulnerability by paypal in which the users invoices were indexed by the Google crawlers 12

and by hitting a right Google dork onto the Internet. 13

Attackers or security researchers were able to identify those invoices. 14

This was also reported to people and it was fixed 15

and insecure storage of data also leads to sensitive data exposure which means if any website or owner 16

is storing some of the important critical files for example db.conf which contains database credentials 17

or login passwords.txt which contains the credentials into its server any user can try to get those 18

files using a directory brute force so why SDE happens? No proper access control over when exchange 19

of sensitive data occurs. 20

There should be proper access controls. Second APIs are not properly protected unauthenticated API which 21

anyone can call for any user also lead to SDE lack of robots.txt file which is very 22

important as I gave the example of paypal wherein the crawler of Google(Google crawler) was able to crawl 23

the invoices. 24

Okay. 25

So robots.txt is a file in which we can write a set of rules which will tell those crawlers 26

what can be crawled from the website website and what cannot be called so lack of data strip when 27

saving at sever is also what can happen because of SDE 28

what can be achieved by sensitivity exposure sensitive information of user as we all know which can 29

also be transaction details passwords etc. APAC api keys which can also be achieved by sensitive data 30

exposure. 31

These types of keys. 32

Generally developers make mistakes and leave these types of keys and tokens into their github repositories. 33

Attackers can also get the tokens of internal portals which are only accessible to domain admins sensitive 34

information like passwords SSL keys a key anything that is sensitive. 35

If you get it falls under the category of sensitivity to exposure which can be misused further by an 36

attacker. 37

So how do we fix sensitive data exposure issues. 38

The first step is don't store sensitive data unnecessary next. 39

Make sure to encrypt all the sensitive data at rest. 40

If you are having any sensitive data at your server just make sure you encrypt everything with a strong 41

corruption and a private key disable caching responses that have sensitive data so disable any application 42

caching any types of responses into their browsers do not put any keys tokens in GitHub or anywhere 43

in the server implement access control for users so a functionality known as make the checker. 44

This is a functionality which is generally used in banks where the maker is the person with low privileges 45

and checker is the person with high privileges. 46

So if the maker is able to bypass those privileges and is able to get the privileges of the checker 47

which means the higher privileges bypassing this access control can also lead to sensitive data exposure 48

issues. 49

Thank you.