Weakness (CWE)
CWE-656: Reliance on Security Through Obscurity
The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
How to prevent it (3 mitigations)
-
Architecture and Design
Always consider whether knowledge of your code or design is sufficient to break it. Reverse engineering is a highly successful discipline, and financially feasible for motivated adversaries. Black-box techniques are established for binary analysis of executables that use obfuscation, runtime analysis of proprietary protocols, inferring file formats, and others.
-
Architecture and Design
When available, use publicly-vetted algorithms and procedures, as these are more likely to undergo more extensive security analysis and testing. This is especially the case with encryption and authentication.
-
Architecture and Design
Obscurity can be one small part of defense
in depth, since it can create more work for an
attacker; however, it is a significant risk if used as
the primary means of protection.
Source: MITRE CWE-656
0 results · Clear filters · Feed