The reasons for attacks on content management systems are considered. Frequent attack scenarios for obtaining unauthorized access are investigated. The method for assessing the probability of a successful attack on a content management system is proposed. Described method uses the attack tree, audit results, source code analysis results, and statistical data. Combinations of basic events for high probability of successful attack are defined. The differences of the proposed method from existing methods of security assessment are shown.
1.1
Demand for modern organizations to provide information in order to increase sales or
provide services implies the creation of information resources on the Internet. Content
management systems are often used to create sites [
Content management system (CMS) is software that allows to edit web pages and
to create websites based on them. Examples of such systems are Wordpress, Joomla
and others. Similar systems have found application in education, for example,
MOODLE – a management system for learning content. Such systems have become
widely known due to ease of use, the number of installations can be measured in
millions of copies. A particular feature of such systems is the modular architecture,
which makes it possible to manage the functionality of the site by installing the
necessary modules. A critical vulnerability in the module can endanger all sites that use this
module, so attackers can hack many of these sites in the same scenario [
Thus, content management systems provide a wide field for information security
activities [
To investigate attack scenarios of web applications, it is suggested to use attack tree
analysis. The method of analysis of trees (failures, attacks) is applied in such spheres
as aviation, nuclear industry, military industry, etc. In the field of information
technology, attack trees can be used to visualize possible ways of attacking various
components of a computer system. In [
Understanding attack scenarios allows to apply the necessary methods for protecting a web application. The results of the web audit give understanding of how much the administrator takes care of the security of his account. Analyzing the source code, unlike testing for black box penetration, allows to detect much more possible vulnerabilities. Statistics provides information about how often specific attack scenarios have been successful. Proceeding from the foregoing, the problem of determining the probability of a successful attack P based on investigation of possible attack scenarios, audit results, source code analysis and statistical data arises.
P f s c e n a r io s , a u d it , s r c , s ta ts (1) Based on research, a method for assessing the probability of the successful attack of a particular site is developing. Conducting either an audit or a penetration testing can’t answer this question, because penetration testing does not cover the problem of noncompliance with security policies, and the audit does not cover the vulnerabilities of the source code. Combining the results of these processes can give a more objective assessment, because the attacks are covered, which can be successful not only because of the exploitation of the vulnerabilities but also because of the violation of security policies. 2
First, you need to determine the main event and investigate possible attack scenarios.
The main event is a successful web application attack. A successful attack involves gaining unauthorized access to functions that are only available to the administrator from the control panel. The attack options are divided into groups and are presented below: ─ attacks with password stealing; ─ attacks with the brute force of password; ─ attacks on vulnerabilities in the content management system.
A fragment of the tree that displays the main event and three ways to achieve it is shown in the Fig. 1. The event "Find out the login and password of the current administrator" means attacking with stealing or selecting a password, i.e. the attacker recognized the administrator credentials. Events "Create new account with privileges" and "Authorization Bypass" are based on the exploitation of vulnerabilities in the content management system.
Attacks with password stealing. The presence of critical vulnerabilities in the content management system increases the likelihood of a successful attack, but in some cases, attackers do not use these vulnerabilities. This is due to the fact that there are several ways to find out the administrator's login and password. For example, an attacker can spy on them while authorizing, being close to the administrator. They can be read on a sticker that lies under the keyboard or is attached to the monitor. They can be intercepted with an unencrypted connection or kidnapped from a mailbox. Most of the above options can be implemented due to a low level of knowledge of the user in the field of information security. To reduce the likelihood of successful use of these scenarios, the requirements of the security policy that prohibit the storage of the password in clear form on digital and non-digital media must be observed.
Attacks with the brute force of a password. An important element of the security policy is the complexity of the password, the prohibition of the use of dictionary passwords, the need for periodic password changes, the prohibition of re-use of passwords, the prohibition of the use of the same passwords on different sites. Attackers can try to crack a password, the harder the password, the less likely the successful cracking password. Using the same password on different sites can have negative consequences – compromising the database of one site reveals the credentials of users who may be the same on another site.
A tree fragment that depicts how to compromise credentials is shown in Figure 2. Attacks on vulnerabilities in the content management system. Defects of the program code allow attackers to penetrate into those parts of the content management system, which should be accessible only to the administrator. There are several classes of vulnerabilities that allow performing administrative functions, among them the following can be distinguished: ─ incorrect processing of access rights to objects; ─ enabling the remote file; ─ running arbitrary code.
Some vulnerabilities can be part of a complex hacking scenario. For example, invalid sanitization of input data allowed to change the logic of the query to the database, there was a compromise of the login and hash of the password. The next step is to crack a password for a known hash – this is another way to get the administrator password.
The content management system may contain vulnerabilities that allow to bypass the authorization mechanism and to gain access to administrator functions. It is difficult to distinguish common cases, so experts will need to assess the possibility of existence of such vulnerabilities in the system under investigation. The tree fragment for the "Authorization Bypass" event is shown in Figure 3. Some vulnerabilities can allow to raise the level of a regular user to an administrator or add a new administrator to the database directly. There are cases when an attacker becomes aware of data to connect to the database (user name and password of the database user). If it is possible to connect directly to the database or access to a webbased database management interface is present, an attacker will be able to access the database and make changes. The creation of a new administrator by an attacker is shown in Figure 4. Trees were chosen because of their representativeness and the ability to use quantitative and qualitative values to determine the probabilities of basic events.
It cannot be said that all possible scenarios were shown above, since some of them can be partially combined, some are unique to specific content management systems. The constructed tree does not take into account the possibility of using two-factor authentication for access to the control panel. It is also assumed that there is no protection against brute force of logins and passwords. 3
The next step is to parameterize the attack tree. The sources of the parameters are web
audit data, statistical data, and source code analysis results. To determine the
probability of each initial event, rules should be established, through which the results of
audit and penetration testing [
P A A N D B m in P A , P B P A O R B m a x P A , P B Let’s consider the definition of probabilities of events associated with the stealing of credentials. The first event is "Credentials are stolen from PC". A low level is assigned by the expert, provided that the credentials are not stored on the computer (in documents, in the browser, etc.). The middle level is assigned if the login and password are stored in the file without the appropriate notations explaining the purpose of these credentials. A high level is assigned when storing credentials in the browser, or in documents explaining to which system these credentials belong.
In the process of audit, it is need to check the complexity of the used passwords
and verify that commonly used logins are not being used. To assess the complexity of
the password, existing services can be used, for example, www.passwordmeter.com.
An example of password protection policies is shown in [
To determine the probability of events associated with the presence and possibility
of exploiting vulnerabilities in the system under consideration, an integrated approach
can be applied. It consists in that, first of all, the system should be checked for known
vulnerabilities. For some vulnerabilities, exploits can be found in open access. At the
next stage, penetration testing [
Similar rules can be developed for each initial event.
Define the parameter sets for the high probability of the occurrence of the main event. As a result of the construction of the tree, there were 16 basic events at the bottom level, from the probability of which the probability of occurrence of the main event depends. In Table 1 high probability is denoted by the symbol "1", the symbol "*" denotes values that do not affect the result of calculations. In some cases, the probability of the main event is determined by the probability of only one basic event. This is due to the fact that OR elements dominate in the constructed tree, in particular, in the upper part of the tree. lliititiitrrrsssaeaeeazauvpynbnoouhBA ifndnuoSCM liliitititrrsssaaeaezuvpynbnoouhBA ittilaenoopx ttiiltiliitirrrrssssaaa”aeeee“novnbudgRm ifreannduoSCM ttiilltiiitirrrrssssaaa”eaeee“onvunbdgRm iittlaeonpox ttiiltrrfrssceaaaaeceaeebonnondodnC noknw tttttrsceaccaaeaecadobnnonkA * * * * * * * * * * * * * * * * * * * * C P m o r f n e l o t s e r a s l a i t n e d e r C 1 * * * * 1 * * * * 1 * * * * 1 * * * * * * * * * * * * * * * * * * * * * * * * 1 1 * * * * * * * * * * 1 * * * * * 1 1 1 * * * * * * * * 1 * * * * * * * * 1 1 * * * * * * 1 * * * * * * * * * * 1 1 * * * * 1 * * * * * * * * * * * * 1 1 * * 1 * * * * * * * * * * * * * 1 1 1
Using the Table 1, combinations of events that are highly likely to lead to a successful attack of the web application can be identified.
For high, medium and low levels, membership functions based on statistics can be
described. Let's assume that with a low probability of 10 attacks, success was from 0
to 3 attacks inclusive, with a medium probability from 4 to 7 attacks were successful,
with a high probability 8 or more attacks were successful. Thus, it is possible to
define a linguistic variable [
1
Formulas 4-6 use a generalized bell-shaped function [
The difference from the existing methods of assessing the security of a web
application, examples of which are given in [
The disadvantage of this approach is the cost of conducting web audit and researching the source code. 4
The aim of the research, which consists in investigating attack scenarios on the web
application and determining the probability of a successful attack, was achieved by
constructing and analyzing the attack tree. The research was based on the assumption
that only the most common attack scenarios [
The direction of further research is related to the identification of the most dangerous attacks and the creation of a method for selecting countermeasures.