Introduction to business logic vulnerabilities 10-18-2012, 02:58 PM
#1
The thing that hackers mostly care about are 'traditional' vulnerabilities which arise from mistakes in code. Many attacks can be also conducted because of misconfigurations - mistakes in administration. Another interesting category is business logic vulnerabilities - mistakes in design and planning.
Theory
What is a business logic vulnerability?
Business logic vulnerability is not about how a program interacts with other programs or how a program works with OS and hardware. Business logic vulnerability is not about programming. Business logic vulnerability is all about interactions between the user and the software.
It's kind of hard to exactly define business logic vulnerabilities, though we can make a simple analogy. Think about videogames. Glitches and cheat codes would be 'traditional' hacking and reading game data from the outside of a game would be misconfiguration. What would business logic exploiting would be? It would be simply an exploitation of overpowered tactics to win the game. Again - not something that the programmers messed but something that went wrong during the design phase.
How critical are business logic vulnerabilities?
It depends. Most of those vulns are not critical, in a sense that by themselves they'll never give an attacker full system access. In many cases they can help though. Also, in certain cases they can be very serious despite not giving the attacker an access to the system (i.e. a BL vuln in a bank's online system that allows to take over user accounts would be extremely dangerous).
Identifying business logic vulnerabilities
Automated scanning of business logic vulnerabilities is not possible, as simple as that. The only way of spotting them is by analyzing how software works on a very high level of abstraction (simply speaking: what 'tools' are given to the user and how can he abuse them even without computer-related knowledge). Sorry, there is no other way.
Basic types of business logic vulnerabilities
BL trolling
This is a low-severity attack, usually abusing edit or delete feature. Good for cheap lulz but there is probably no way of using it to conduct an attack. Works when posts can be deleted or edited and one of those is true:
1. you can reply but cannot quote
2. posts gather likes and editing doesn't remove them
3. posting is moderated and editing isn't.
This is an old one about editing posts in G+ from the times when people thought G+ will not be a desolate wasteland: http://imageshack.us/photo/my-images/201...ongoo.jpg/
BL denial of service
This is a medium-severity attack, might be high-severity in some cases. It usually abuses the in-built security measures to lock out user accounts. The most evil examples I know from experience are intentionally using programs like hitfaker on the AdSense ads placed on victim's website so that the scanners will pick them up and think that he was abusing the service and deny him payment and logging in multiple times with bad password and good login to Mt. Gox to temporarily lock out the account and make it impossible to exchange BTC for some time.
Account takeover
Now this is where shit gets real. This is a high-severity attack on most of websites and a critical-severity one on any website/software/service that fulfills any of those conditions:
1. allows money transaction or stores credit card numbers (allows fraud)
2. allows access to e-mails (allows getting many other credentials easily)
3. allows access to webhosting (foothold into the server)
4. allows remote access to a computer (direct access)
5. allows admin access through the same account system as user access and doesn't require admins to log-in from IP-whitelisted computers (foothold into the server)
This vulnerability usually takes a form of badly designed password recovery system. There are many ways such a system can go wrong: maybe just typing in the victim's e-mail will provide you with a password. Maybe the possible answers to a questions are easily bruteforceable/publicly known. There is even a good one for facebook here on HC (not sure if it still works, haven't used for quite a long time): http://www.hackcommunity.com/Thread-How-...b-Friendly .
Conclusion
BL vulnerabilities aren't well-researched and cannot be detected automatically and that's one of the things that makes them dangerous. There are many kinds of them (my post is just scratching the surface) and some of them can be combined with other types of attacks for very powerful exploit. Don't get fooled by the fact that most of them are not serious - the important thing is that some of them are.
Further reading
Theory
Examples
Theory
What is a business logic vulnerability?
Business logic vulnerability is not about how a program interacts with other programs or how a program works with OS and hardware. Business logic vulnerability is not about programming. Business logic vulnerability is all about interactions between the user and the software.
It's kind of hard to exactly define business logic vulnerabilities, though we can make a simple analogy. Think about videogames. Glitches and cheat codes would be 'traditional' hacking and reading game data from the outside of a game would be misconfiguration. What would business logic exploiting would be? It would be simply an exploitation of overpowered tactics to win the game. Again - not something that the programmers messed but something that went wrong during the design phase.
How critical are business logic vulnerabilities?
It depends. Most of those vulns are not critical, in a sense that by themselves they'll never give an attacker full system access. In many cases they can help though. Also, in certain cases they can be very serious despite not giving the attacker an access to the system (i.e. a BL vuln in a bank's online system that allows to take over user accounts would be extremely dangerous).
Identifying business logic vulnerabilities
Automated scanning of business logic vulnerabilities is not possible, as simple as that. The only way of spotting them is by analyzing how software works on a very high level of abstraction (simply speaking: what 'tools' are given to the user and how can he abuse them even without computer-related knowledge). Sorry, there is no other way.
Basic types of business logic vulnerabilities
BL trolling
This is a low-severity attack, usually abusing edit or delete feature. Good for cheap lulz but there is probably no way of using it to conduct an attack. Works when posts can be deleted or edited and one of those is true:
1. you can reply but cannot quote
2. posts gather likes and editing doesn't remove them
3. posting is moderated and editing isn't.
This is an old one about editing posts in G+ from the times when people thought G+ will not be a desolate wasteland: http://imageshack.us/photo/my-images/201...ongoo.jpg/
BL denial of service
This is a medium-severity attack, might be high-severity in some cases. It usually abuses the in-built security measures to lock out user accounts. The most evil examples I know from experience are intentionally using programs like hitfaker on the AdSense ads placed on victim's website so that the scanners will pick them up and think that he was abusing the service and deny him payment and logging in multiple times with bad password and good login to Mt. Gox to temporarily lock out the account and make it impossible to exchange BTC for some time.
Account takeover
Now this is where shit gets real. This is a high-severity attack on most of websites and a critical-severity one on any website/software/service that fulfills any of those conditions:
1. allows money transaction or stores credit card numbers (allows fraud)
2. allows access to e-mails (allows getting many other credentials easily)
3. allows access to webhosting (foothold into the server)
4. allows remote access to a computer (direct access)
5. allows admin access through the same account system as user access and doesn't require admins to log-in from IP-whitelisted computers (foothold into the server)
This vulnerability usually takes a form of badly designed password recovery system. There are many ways such a system can go wrong: maybe just typing in the victim's e-mail will provide you with a password. Maybe the possible answers to a questions are easily bruteforceable/publicly known. There is even a good one for facebook here on HC (not sure if it still works, haven't used for quite a long time): http://www.hackcommunity.com/Thread-How-...b-Friendly .
Conclusion
BL vulnerabilities aren't well-researched and cannot be detected automatically and that's one of the things that makes them dangerous. There are many kinds of them (my post is just scratching the surface) and some of them can be combined with other types of attacks for very powerful exploit. Don't get fooled by the fact that most of them are not serious - the important thing is that some of them are.
Further reading
Theory
Examples
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
