How Can We Help?
Internet is flooded with more and more private information that is being used by web applications, and this makes information security a critical issue. The harvesting of sensitive data Incidents involving take place on a constant basis all over the world. This stealing of private information by malicious attackers is known as privacy violation.
Passwords, credit card details, certificates, addresses, social security numbers, mobile numbers and email IDs are usually targeted by cyber criminals’. Despite security regulations that are being enforced in the various industrial sectors today, privacy violation is still a common occurrence.
What is privacy violation?
Most of today’s web require the use of private data to provide users with added functionality. But low security-awareness can cause improper handling of this sensitive data. Privacy violation takes place when sensitive information is illegally accessed by malicious attackers.
There are three common occurrences of Privacy Violation:
•User Data Stored in Unprotected Location
Most privacy violation occurs when credentials used by application like; login and personal information are stored in plain-text format. This insecure way of programming eventually puts the application user’s private information at risk.
•Misplaced trust and improper handling of sensitive information.
This aspect is often overseen by application developers, who trust the operating environment in which the program runs. Even restricted areas are not safe as authorized users cannot be trusted unconditionally.
•Display of sensitive data on end-devices.
Sensitive information is displayed on end-devices such as mobile phone screens and computer monitors, enabling malicious attackers to harvest the information with the help of various screen-capture tools and internet sniffers.
•Privacy violation examples
Example 1
In 2004, an employee at AOL sold approximately 92 million private customer e-mail addresses to a spammer marketing an offshore gambling web site [REF-338]. In response to such high-profile exploits, the collection and management of private data is becoming increasingly regulated.
Example 2
The following code contains a logging statement that tracks the contents of records added to a database by storing them in a log file. Among other values that are stored, the getPassword() function returns the user-supplied plaintext password associated with the account.
Example Language: C#
pass = GetPassword();
dbmsLog.WriteLine(id + “:” + pass + “:” + type + “:” + tstamp);
The code in the example above logs a plaintext password to the filesystem. Although many developers trust the filesystem as a safe storage location for data, it should not be trusted implicitly, particularly when privacy is a concern.
Example 3
This code uses location to determine the user’s current US State location.
First the application must declare that it requires the ACCESS_FINE_LOCATION permission in the application’s manifest.xml: (bad code)
Example Language: XML
<uses-permission android:name=”android.permission.ACCESS_FINE_LOCATION”/>
During execution, a call to getLastLocation() will return a location based on the application’s location permissions. In this case the application has permission for the most accurate location possible:
Example Language: Java
locationClient = new LocationClient(this, this, this);
locationClient.connect();
Location userCurrLocation;
userCurrLocation = locationClient.getLastLocation();
deriveStateFromCoords(userCurrLocation);
While the application needs this information, it does not need to use the ACCESS_FINE_LOCATION permission, as the ACCESS_COARSE_LOCATION permission will be sufficient to identify which US state the user is in.
This use of escalated privilege is unnecessary and violates the user’s privacy as the US state can be determined with the less intrusive ACCESS_COARSE_LOCATION permission. The use of the ACCESS_FINE_LOCATION permission discloses the user’s exact location, sensitive information that can be redistributed without their prior knowledge or harvested by malicious hackers.
What are the damages caused by Privacy Violation?
•Identity theft (passwords, login details, etc).
•Personal data leakage (location, health information, etc).
•Harvesting of sensitive data saved in plain-text via data queries and statistics.
•Information exposure through error messages – self-generated, externally-generated and server error generated.