Use of Hard-coded Cryptographic Key

Opis

The product uses a hard-coded, unchangeable cryptographic key.

Skutki

• Access Control

  Bypass Protection Mechanism; Gain Privileges or Assume Identity; Read Application Data

  If hard-coded cryptographic keys are used, it is almost certain that malicious users will gain access through the account in question. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Zapobieganie

• Architecture and Design

  Prevention schemes mirror that of hard-coded password storage.

Przykłady podatności

• CVE-2022-29960 Engineering Workstation uses hard-coded cryptographic keys that could allow for unathorized filesystem access and privilege escalation
• CVE-2022-30271 Remote Terminal Unit (RTU) uses a hard-coded SSH private key that is likely to be used by default.
• CVE-2020-10884 WiFi router service has a hard-coded encryption key, allowing root access
• CVE-2014-2198 Communications / collaboration product has a hardcoded SSH private key, allowing access to root account

Słabość nadrzędna

• CWE-798 Use of Hard-coded Credentials

Kiedy powstaje

• Architecture and Design — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific, ICS/OT

Uwagi

The main difference between the use of hard-coded passwords and the use of hard-coded cryptographic keys is the false sense of security that the former conveys. Many people believe that simply hashing a hard-coded password before storage will protect the information from malicious users. However, many hashes are reversible (or at least vulnerable to brute force attacks) -- and further, many authentication protocols simply request the hash itself, making it no better than a password.

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022