Weakness (CWE)
CWE-656: Reliance on Security Through Obscurity
The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
How to prevent it (3 mitigations)
-
Architecture and Design
Always consider whether knowledge of your code or design is sufficient to break it. Reverse engineering is a highly successful discipline, and financially feasible for motivated adversaries. Black-box techniques are established for binary analysis of executables that use obfuscation, runtime analysis of proprietary protocols, inferring file formats, and others.
-
Architecture and Design
When available, use publicly-vetted algorithms and procedures, as these are more likely to undergo more extensive security analysis and testing. This is especially the case with encryption and authentication.
-
Architecture and Design
Obscurity can be one small part of defense
in depth, since it can create more work for an
attacker; however, it is a significant risk if used as
the primary means of protection.
Source: MITRE CWE-656
4 results · Clear filters · Feed
-
Medium 6.9
Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default conf…
-
Medium 5.1
BYD DiLink OS Incorrect encryption Implementation of system log dumps
An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS (e.g. in the model ATTO3). An attacker with physical access to the vehicle can bypass the encryption of log dumps on the In-Vehicle Infotainment …
-
Medium 5.0
TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability
TP-Link Omada ER605 Reliance on Security Through Obscurity Vulnerability. This vulnerability allows network-adjacent attackers to access or spoof DDNS messages on affected installations of TP-Link Omada ER605 routers. Authentication is not required to exploit…
-
Medium 6.4
RVD#2562: Booting from a live image leads to exfiltration of sensible information and privilege escalation
There is no mechanism in place to prevent a bad operator to boot from a live OS image, this can lead to extraction of sensible files (such as the shadow file) or privilege escalation by manually adding a new user with sudo privileges on the machine.