Introduction: What is software and data integrity failure?
Software and data integrity failures refer to the state of corruption or integrity violation of data or software for which no proper checks are in place in the present infrastructure of the organization. Integrity violation of data and the software includes scenarios where any unauthorized entity modifies the data crucial to an organization’s working or modifies the code of components being utilized by the software for its working. This vulnerability is ranked 8th position for OWASP’s top 10 2021 list. Here’s a dummy example of one such scenario.
A server administrator gets an alert for a critical update which is needed to be installed urgently to mitigate a security issue. After doing a lookup in the catalog provided by the software provider the admin was convinced that the manufacturer had issued the update a long time ago. Ignoring the fact that the update was issued a long time ago, the admin installed the update without verifying the digital signatures of the update and ignored the digital signature integrity check warning. This series of events, later on, lead to a ransomware attack on the entire infrastructure of the organization just because of one single update which wasn’t verified with the signatures which turned out to be the culprit as it contained malicious code stuffed alongside update files.
Attack Surface
- Network vulnerabilities
Attackers may try to exploit vulnerabilities in network infrastructure to gain access to a system.
Example: Due to insufficient configuration of the database server, an attacker was able to gain access to the database through default credentials and was able to modify the details of many users existing in the database.
- Software vulnerabilities
Attackers may try to find and exploit flaws or weaknesses in software to gain access to a system or commit data theft.
Example: An attacker found a vulnerable version of server-hosting software which he then exploited to gain access to the server and plant a backdoor into the server to gain access to the server remotely.
- User credentials
Attackers may try to obtain user credentials, such as passwords or login information, to gain unauthorized access to a system or data.
Example: An attacker found the database credentials of a company in a mass credential dump online through which the attacker gained access to the database and dropped a crucial data table needed by the organization and then demanded a ransom to get the data back.
- Physical access
Attackers may try to physically access a system or data storage device, such as by stealing a laptop or accessing a server room.
Example: An attacker managed to infiltrate the security and gained access to an organization’s data center. The attacker tampered with the main domain controller of the network by installing a USB rubber ducky.
- Social engineering
Attackers may try to trick users into giving them access to a system or data by using techniques such as phishing or pretexting.
Example: An attacker was able to successfully trick an employee of the target organization into installing a pdf viewer with a malicious payload stuffed inside through which he was able to gain access to the organization’s network and sensitive data present on the organization’s server.
- Insider threats
Employees or contractors with authorized access to a system or data may intentionally or unintentionally compromise its integrity.
Example: An employee who was fed up with the payout he was getting decided to stuff dummy data into an application utilized by the organization for managing purchase orders to fake purchase orders and getting money through them from the organization.
Examples of software and data integrity failures
Scenario #1:An update without a signature.
The software of many set-top boxes, home routers, devices, and other things does not validate updates using signed firmware. Attackers are increasingly focusing on unsigned firmware, and this situation is only going to become worse. This is a serious issue since frequently there is no way to correct it other than to wait for an older version to become obsolete.
Scenario #2: Malicious SolarWinds update:
Nation-states have a history of attacking updating systems; one such attack that happened recently was the SolarWinds Orion strike. The software developer used it safely to build and update integrity procedures.
Nevertheless, these could be bypassed, and for a few months, the company sent a highly targeted malicious update to over 18,000 businesses, of which just around 100 were affected. It is among the largest and most important breaches of this kind in recorded history.
Scenario #3: Insecure Deserialization
A collection of Spring Boot microservices is called by a React application. They tried to guarantee that their code is immutable because they are functional programmers. They came up with the idea to serialize the user state and send it back and forth with each request as their solution. In order to get remote code execution on the application server, an attacker utilizes the Java Serial Killer tool after noticing the Java object signature (in base64).
What’s the Impact of software and data integrity failures?
Software and data integrity failures can have serious consequences, including loss of data, financial loss, and damage to a company’s reputation. Some common causes of software and data integrity failures include:
- Human error: This can include mistakes made by programmers or users when inputting, accessing, or modifying data.
- Hardware failure: This can include problems with servers, storage devices, or other hardware components that can cause data loss or Corruption.
- Software bugs: These are errors or defects in software that can cause it to malfunction or produce incorrect results.
- Cybersecurity threats: These can include cyber-attacks, viruses, and other malicious software that can compromise the integrity of the software and data.
To prevent software and data integrity failures, it is important to have robust quality control measures in place to catch and fix defects in software, to have strong cybersecurity measures in place to protect against threats, and to have contingency plans in place to minimize the impact of hardware failures or other unexpected events.
What’s the remediation of software and data integrity failures?
Data snapshots and backups are a must-have for an organization to roll back to a previous snapshot in case of such failure. Software patching and the installation procedure should include verifying the digital signatures of individual components before installation or upgradation. Here are some points which can help in mitigating the risk of such a failure:
- Verify the program or data is from the anticipated source and has not been changed by using digital signatures or equivalent procedures.
- Make certain that libraries and dependencies, such as npm or Maven, are utilizing reliable sources. Consider hosting an internal, validated known- good repository if your risk profile is greater.
- Make sure to utilize a software supply chain security tool to confirm that components don’t include known vulnerabilities, such as OWASP Dependency Check or OWASP CycloneDX.
- To lessen the possibility of harmful code or configuration entering your software pipeline, make sure there is a review procedure in place for modifications to configuration and code.
Software and data integrity failures can have serious consequences, such as loss of data, financial losses, and damage to a company’s reputation. Therefore, it is important to have a plan in place to address and remediate these failures as quickly as possible.
To learn more about how to manage cyber risk in your organization, contact ASPIA Infotech.
