All language subtitles for 3. What is Senstive Data Exposure

Hello everyone.
1

So let's continue to the third vulnerability of OWASP that is sensitive data exposure.
2

So what is SDE when any application or API do not protect sensitive data properly like for example
3

user Account details, Credit card details or Passwords etc. Then SDE Vulnerability arises.
4

Also if an attacker can view this sensitive data and get access to the internal network also git hub
5

tokens and API keys which had been leaked on to the Internet can also lead to sensitive data exposure.
6

A very good example to this is a Snapchat report which was submitted by a security researcher on Hackerone
7

wherein he was able to find out a token which was indexed by Google and that token was into GitHub.
8

So he reported that token and he got 15,000$ of bounty basically reward for that specific
9

bug.
10

So SDE can be very critical and dangerous also sensitive invoices which are indexed by Google.
11

There was again a vulnerability by paypal in which the users invoices were indexed by the Google crawlers
12

and by hitting a right Google dork onto the Internet.
13

Attackers or security researchers were able to identify those invoices.
14

This was also reported to people and it was fixed
15

and insecure storage of data also leads to sensitive data exposure which means if any website or owner
16

is storing some of the important critical files for example db.conf which contains database credentials
17

or login passwords.txt which contains the credentials into its server any user can try to get those
18

files using a directory brute force so why SDE happens?
No proper access control over when exchange
19

of sensitive data occurs.
20

There should be proper access controls. Second APIs are not properly protected unauthenticated API which
21

anyone can call for any user also lead to SDE lack of robots.txt file which is very
22

important as I gave the example of paypal wherein the crawler of Google(Google crawler) was able to crawl
23

the invoices.
24

Okay.
25

So robots.txt is a file in which we can write a set of rules which will tell those crawlers
26

what can be crawled from the website website and what cannot be called so lack of data strip when
27

saving at sever is also what can happen because of SDE
28

what can be achieved by sensitivity exposure sensitive information of user as we all know which can
29

also be transaction details passwords etc. APAC api keys which can also be achieved by sensitive data
30

exposure.
31

These types of keys.
32

Generally developers make mistakes and leave these types of keys and tokens into their github repositories.
33

Attackers can also get the tokens of internal portals which are only accessible to domain admins sensitive
34

information like passwords SSL keys a key anything that is sensitive.
35

If you get it falls under the category of sensitivity to exposure which can be misused further by an
36

attacker.
37

So how do we fix sensitive data exposure issues.
38

The first step is don't store sensitive data unnecessary next.
39

Make sure to encrypt all the sensitive data at rest.
40

If you are having any sensitive data at your server just make sure you encrypt everything with a strong
41

corruption and a private key disable caching responses that have sensitive data so disable any application
42

caching any types of responses into their browsers do not put any keys tokens in GitHub or anywhere
43

in the server implement access control for users so a functionality known as make the checker.
44

This is a functionality which is generally used in banks where the maker is the person with low privileges
45

and checker is the person with high privileges.
46

So if the maker is able to bypass those privileges and is able to get the privileges of the checker
47

which means the higher privileges bypassing this access control can also lead to sensitive data exposure
48

issues.
49

Thank you.