"If a person has control over any function, it can also be used to control the computer"(week 14)
"If a person has control over any function,
it can also be used to control the computer"
Last year,
Laxman Muthiyah, a security researcher, found out that it was possible for any
attacker to assign themselves admin privileges for any Facebook page they
desired.[1] The operation was done through Broken Access Control,
which happens when access permissions are misconfigured by the attacker
allowing them to gain access to functions they are not supposed to have.[2]
With this access they may delete, modify, or copy, different data, files, and
account information amongst other things.
The opportunity
of Broken Access Control to take place relies completely on how securely
designed and coded the webpage or application is. In Facebook’s case, it was a
flaw in their code which allowed Laxman to give himself admin privileges. Luckily,
Laxman was merely bug-hunting, and his intentions were not malignant in nature.
He proceeded to report the bug to Facebook and was rewarded with a monetary
prize.
Here is the
request Laxman used to gain admin privileges:
Request :-
POST
/<page_id>/userpermissions HTTP/1.1
Host :
graph.facebook.com
Content-Length:
245
role=MANAGER&user=<target_user_id>&business=<associated_business_id>&access_token=<application_access_token>
Response:-
true
Broken
Access Control is one of the many instances in which attackers make use of
gateways and functions to gain access and control. While Laxman’s case was
inoffensive, it is a common occurrence for attackers to gain access and control
through different techniques, such as Broken Access Control.
Other technique very commonly used by attackers is phishing. A phishing attack occurs when attackers trick you, by sending fake emails for example, into giving them valuable information, or in this case, control of the computer.[3] One example could be a fake email with a web link. This web link could install malware into the computer or give complete control to the attacker. Other instances of phishing have shown web links guiding to sites replicating bank or company portals, asking the victim to insert their personal data and passwords without knowing that the site is fake.
Such
happened in December last year in the United States, that an employee of a
wireless communications manufacturer in New York was arrested in relation to a
data breach. His name is Nickolas Sharp, and he is accused of “stealing
gigabytes of confidential files.” After gaining access and stealing the files,
he attempted to extort the firm for nearly two million dollars for their return
and an explanation of how he managed to gain access and control.[4]
But how did
he do it? Well, he worked as an Amazon Web Services cloud administrator. This
position gave him enough access privileges, which he misused alongside a VPN,
giving him access through what he called a “backdoor” which gave him complete
access to download confidential data.
In
cybersecurity there exists the principle, “if a person has control over any
function, it can also be used to control the computer.” Whether it is by gaining
admin privileges for a Facebook page through Broken Access Control, fishing
valuable information through fake emails, or gaining access to confidential
data misusing access privileges, a single function can compromise the entire
computer, and even an entire organization or company.
Sources:
Comments
Post a Comment