Weakness (CWE)
CWE-656: Reliance on Security Through Obscurity
The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
How to prevent it (3 mitigations)
-
Architecture and Design
Always consider whether knowledge of your code or design is sufficient to break it. Reverse engineering is a highly successful discipline, and financially feasible for motivated adversaries. Black-box techniques are established for binary analysis of executables that use obfuscation, runtime analysis of proprietary protocols, inferring file formats, and others.
-
Architecture and Design
When available, use publicly-vetted algorithms and procedures, as these are more likely to undergo more extensive security analysis and testing. This is especially the case with encryption and authentication.
-
Architecture and Design
Obscurity can be one small part of defense
in depth, since it can create more work for an
attacker; however, it is a significant risk if used as
the primary means of protection.
Source: MITRE CWE-656
2 results · Clear filters · Feed
-
High 8.5
Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300
Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from t…
-
High 7.2
Privilege Escalation in Cellular Router, Secure Router, and Network Security Appliances
Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138. This vulnerability involves hard-coded credentials, enabling an authenticated user to escalate privileges and gain root-leve…