Skip to main content

Non-encrypted confidential information - Credit Cards

Need​

Secure encryption and masking of credit card information

Context​

  • Usage of Java for building cross-platform applications
  • Usage of javax.servlet for building Java web applications
  • Usage of java.io for input and output operations in Java

Description​

Non compliant code​

import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;

public class PaymentServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String cardNumber = request.getParameter("cardNumber");
        String cardExpiry = request.getParameter("cardExpiry");
        String cardCVV = request.getParameter("cardCVV");
        
        processPayment(cardNumber, cardExpiry, cardCVV);
    }

    private void processPayment(String cardNumber, String cardExpiry, String cardCVV) {
        // process payment
    }
}

The above code is an example of a servlet that processes payments. It takes as input the credit card number, expiry date, and CVV number from the request parameters. The problem with this code is that it does not encrypt this sensitive information.

The credit card details are sent to the server as plain text, which means that anyone who can intercept the request (for instance, through a Man-in-the-Middle attack) would be able to see the credit card details. This is a serious security vulnerability.

Also, the credit card details are stored in memory as plain text while the request is being processed. If an attacker were able to access the server's memory (for instance, through a memory dump), they would be able to retrieve the credit card details.

This code violates the Payment Card Industry Data Security Standard (PCI DSS), which requires that credit card details be encrypted when they are transmitted over a network. To fix this vulnerability, the credit card details should be encrypted before they are sent to the server, and they should remain encrypted while they are stored in memory on the server.

Steps​

  • Implement encryption for sensitive information such as credit card details.
  • Use a secure encryption algorithm to encrypt the credit card details.
  • Ensure that the encryption keys are securely stored and managed.
  • Implement secure transmission protocols such as HTTPS to protect the data during transit.
  • Use secure storage mechanisms to store the encrypted credit card details.
  • Implement access controls to restrict unauthorized access to the encrypted credit card details.
  • Regularly update and patch the encryption libraries and frameworks used in the application.
  • Follow PCI DSS standards and guidelines for handling and protecting credit card information.

Compliant code​

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.security.Key;
import java.util.Base64;

public class PaymentServlet extends HttpServlet {

    private static final String ALGORITHM = "AES";
    private static final byte[] KEY = "MySuperSecretKey".getBytes();

    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String cardNumber = request.getParameter("cardNumber");
        String cardExpiry = request.getParameter("cardExpiry");
        String cardCVV = request.getParameter("cardCVV");

        String encryptedCardNumber = encrypt(cardNumber);
        String encryptedCardExpiry = encrypt(cardExpiry);
        String encryptedCardCVV = encrypt(cardCVV);

        processPayment(encryptedCardNumber, encryptedCardExpiry, encryptedCardCVV);
    }

    private void processPayment(String cardNumber, String cardExpiry, String cardCVV) {
        // process payment
    }

    private String encrypt(String data) {
        try {
            Cipher cipher = Cipher.getInstance(ALGORITHM);
            Key secretKey = new SecretKeySpec(KEY, ALGORITHM);
            cipher.init(Cipher.ENCRYPT_MODE, secretKey);
            byte[] encryptedData = cipher.doFinal(data.getBytes());
            return Base64.getEncoder().encodeToString(encryptedData);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
}

The updated code now includes encryption for sensitive information such as credit card details. The encrypt method uses the AES encryption algorithm to encrypt the data. The encryption key is stored as a constant byte array, but in a real-world scenario, it should be securely stored and managed.

The doPost method now encrypts the credit card details before processing the payment. The encrypted data is then passed to the processPayment method.

This code also assumes that the application is using a secure transmission protocol such as HTTPS to protect the data during transit. It is also assumed that secure storage mechanisms are used to store the encrypted credit card details and that access controls are in place to restrict unauthorized access to these details.

Regular updates and patches should be applied to the encryption libraries and frameworks used in the application. The application should also follow PCI DSS standards and guidelines for handling and protecting credit card information.

References​

Last updated on