Skip to main content

Security controls bypass or absence - Tampering Protection

Need​

Implementation of tampering detection and protection mechanisms

Context​

  • Usage of Go 1.16 for building efficient and scalable applications
  • Usage of Gin framework for building web applications in Go
  • Usage of net/http for handling HTTP requests and responses in a Node.js server

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
)

func main() {
	r := gin.Default()

	r.GET("/root_check", func(c *gin.Context) {
		c.JSON(http.StatusOK, gin.H{
			"message": "Root user detected",
		})
	})

	r.Run() // listen and serve on 0.0.0.0:8080 (for windows "localhost:8080")
}

In the above code, we have a simple Gin server running with a single endpoint "/root_check". When a GET request is made to this endpoint, the server responds with a JSON object stating "Root user detected".

However, there is a significant security vulnerability here. The application does not have any control to ensure that a third party has not modified and recompiled the application. This means that a malicious user could potentially modify the code and recompile the application to bypass the root user detection.

For instance, an attacker could remove the root user detection code and replace it with a function that always returns false, making the application believe that no root user is present. This would allow the attacker to perform actions that should be restricted to non-root users.

The absence of tampering protection makes this application susceptible to unauthorized modifications and potentially harmful actions.

In addition, this code does not actually check if the user is a root user or not. It simply responds with a message saying "Root user detected" regardless of the user's privileges. This could lead to false positives and potential security risks if the application relies on this check to restrict access to certain functionalities.

Therefore, it is crucial to implement proper security controls and tampering protection to prevent unauthorized modifications to the application and ensure accurate root user detection.

Steps​

  • Implement code integrity checks to ensure that the application has not been modified or tampered with.
  • Use secure coding practices to prevent unauthorized modifications to the application.
  • Implement strong authentication and authorization mechanisms to protect against unauthorized access.
  • Regularly update and patch the application to address any known vulnerabilities.
  • Implement logging and monitoring to detect any suspicious activities or tampering attempts.
  • Perform security testing and code reviews to identify and fix any vulnerabilities in the application.
  • Follow secure development practices and guidelines to minimize the risk of tampering and bypassing security controls.

Compliant code​

package main

import (
	"crypto/sha256"
	"encoding/hex"
	"github.com/gin-gonic/gin"
	"io/ioutil"
	"net/http"
	"os"
)

func main() {
	r := gin.Default()

	r.GET("/root_check", func(c *gin.Context) {
		// Read the original file
		originalFile, err := ioutil.ReadFile(os.Args[0])
		if err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{
				"message": "Error reading the file",
			})
			return
		}

		// Calculate the SHA256 hash of the original file
		originalHash := sha256.Sum256(originalFile)
		originalHashString := hex.EncodeToString(originalHash[:])

		// Compare the original hash with the current hash
		if originalHashString != "your_pre_calculated_hash" {
			c.JSON(http.StatusUnauthorized, gin.H{
				"message": "The application has been tampered with",
			})
			return
		}

		c.JSON(http.StatusOK, gin.H{
			"message": "Root user detected",
		})
	})

	r.Run() // listen and serve on 0.0.0.0:8080 (for windows "localhost:8080")
}

The updated code now includes a mechanism to check the integrity of the application. It does this by calculating the SHA256 hash of the original file and comparing it with a pre-calculated hash. If the hashes do not match, it means that the application has been tampered with and an unauthorized modification has been made.

This mechanism helps to prevent security control bypass and tampering protection vulnerabilities by ensuring that the application has not been modified or recompiled by a third party. It also provides a way to detect if a root user has been detected on the device.

Please note that you need to replace "your_pre_calculated_hash" with the actual SHA256 hash of the original file. This hash should be calculated and stored securely when the application is first compiled and deployed.

This is a basic implementation and may need to be adapted based on the specific requirements and context of your application. For example, you may want to implement additional security controls such as strong authentication and authorization mechanisms, regular updates and patches, logging and monitoring, security testing and code reviews, and following secure development practices and guidelines.

References​

Last updated on