Tag Archive for: Excessive

Excessive Data Exposure: What It Is, How We Can Help


No. 3 on the OWASP API Top 10 vulnerabilities list is excessive data exposure (after BOLA and broken user authentication). OWASP says of this vulnerability, “Looking forward to generic implementations, developers tend to expose all object properties without considering their individual sensitivity, relying on clients to perform the data filtering before displaying it to the user.” 

How Do Excessive Data Exposure Exploits Work? 

Attackers can probe for excessive data exposure in a number of ways. They can analyze legitimate response traffic, looking for exposed sensitive data, or, more commonly, they can look for human patterns – development team practices – that indicate ways to attack an API. 

OWASP gives this example: 

The mobile team uses the /api/articles/{articleId}/comments/{commentId} endpoint in the articles view to render comments metadata. Sniffing the mobile application traffic, an attacker finds out that other sensitive data related to comment’s author is also returned. The endpoint implementation uses a generic toJSON() method on the User model, which contains PII, to serialize the object. 

How to Prevent Excessive Data Exposure 

It’s a common practice when building APIs for developers to simply serialize all the data related to a particular API resource, irrespective of that data’s sensitivity. This practice may seem like a common sense time-saving design pattern, but it can result in an info leak, where sensitive data is exposed to unauthorized clients, or bad actors. A more defensive practice is to clearly classify data in a system, and to define a separate data model for public interfaces such as APIs. 

Bottom line for developers: Be conservative about what data you return in API responses. It might seem like a great idea to “future-proof” an API, making it applicable for applications that were not originally envisioned by the application owner. But, a future fraught with data breaches isn’t on anyone’s bucket list. Instead, be conservative in resource representations and only include data necessary for well-understood use cases. This conservative approach dramatically decreases implementation effort, and also presents…

Source…

Supreme Court Says Civil Asset Forfeiture Violates Constitutional Protections Against Excessive Fines

Great news on the asset forfeiture front, courtesy of the highest court in the land. The Supreme Court has ruled that forfeitures can violate the Eighth Amendment’s protections against excessive fines.

The case the Supreme Court ruled on deals with Indiana native Tyson Timbs. Timbs sold $ 260 worth of heroin to undercover officers. He pled guilty to criminal charges. The state decided to forfeit his $ 42,000 Land Rover via civil asset forfeiture, routing around the criminal system to make it easier for cops to make off with his vehicle. Timbs challenged this forfeiture as an excessive fine, given that the max fine for his criminal charges was $ 10,000.

This case made its way to the state’s Supreme Court, which overturned the lower court’s decision finding in favor of Timbs and the US Constitution, which Indiana had incorporated. The state’s highest court stated that this clause of the Eighth Amendment did not apply to civil asset forfeiture. This was a bizarre position to take, as the Supreme Court pointed out during oral arguments.

JUSTICE GORSUCH: Well, whatever the Excessive Fine Clause guarantees, we can argue, again, about its scope and in rem and in personam, but whatever it, in fact, is, it applies against the states, right?

MR. FISHER: Well, again, that depends.

JUSTICE GORSUCH: I mean, most — most of the incorporation cases took place in like the 1940s.

MR. FISHER: Right.

JUSTICE GORSUCH: And here we are in 2018 -­

MR. FISHER: Right.

JUSTICE GORSUCH: — still litigating incorporation of the Bill of Rights. Really? Come on, General.

The Supreme Court’s decision [PDF] makes it clear the US Constitution protects citizens from excessive fines, even if those fines are meted out at the state level. If the Constitution has been incorporated by the states (and it has!), the protections apply.

Held: The Eighth Amendment’s Excessive Fines Clause is an incorporated protection applicable to the States under the Fourteenth Amendment’s Due Process Clause. Pp. 2–9. (a) The Fourteenth Amendment’s Due Process Clause incorporates and renders applicable to the States Bill of Rights protections “fundamental to our scheme of ordered liberty,” or “deeply rooted in this Nation’s history and tradition.” McDonald v. Chicago, 561 U. S. 742, 767 (alterations omitted). If a Bill of Rights protection is incorporated, there is no daylight between the federal and state conduct it prohibits or requires.

The state tried to argue the protections only covered in personam (vs. a person) forfeiture — the kind normally seen in criminal cases where property is seized as compensation for fines or as direct, provable ill-gotten goods obtained as the result of criminal activity.

In rem forfeiture — the civil route — lowers the evidentiary bar law enforcement must meet to take property away from citizens. In most cases, there are no criminal charges involved — only accusations of criminal origin that force citizens to prove a negative to reclaim their seized property.

Here’s where this decision has the chance to disrupt a majority of states’ civil asset forfeiture programs: the Supreme Court says these incorporated protections also apply to in rem seizures.

As a fallback, Indiana argues that the Excessive Fines Clause cannot be incorporated if it applies to civil in rem forfeitures. We disagree. In considering whether the Fourteenth Amendment incorporates a protection contained in the Bill of Rights, we ask whether the right guaranteed—not each and every particular application of that right—is fundamental or deeply rooted.

Indiana’s suggestion to the contrary is inconsistent with the approach we have taken in cases concerning novel applications of rights already deemed incorporated. For example, in Packingham v. North Carolina, 582 U. S. ___ (2017), we held that a North Carolina statute prohibiting registered sex offenders from accessing certain commonplace social media websites violated the First Amendment right to freedom of speech. In reaching this conclusion, we noted that the First Amendment’s Free Speech Clause was “applicable to the States under the Due Process Clause of the Fourteenth Amendment.” Id., at ___ (slip op., at 1). We did not, however, inquire whether the Free Speech Clause’s application specifically to social media websites was fundamental or deeply rooted. See also, e.g., Riley v. California, 573 U. S. 373 (2014) (holding, without separately considering incorporation, that States’ warrantless search of digital information stored on cell phones ordinarily violates the Fourth Amendment). Similarly here, regardless of whether application of the Excessive Fines Clause to civil in rem forfeitures is itself fundamental or deeply rooted, our conclusion that the Clause is incorporated remains unchanged.

So, the rhetorical question posed by this decision is one that’s going to be asked of hundreds of state-level civil asset forfeiture programs: if there are no criminal charges, wouldn’t ANY seizure of property be “excessive?” It certainly appears a lack of criminal charges would be fatal to in rem seizures, which almost always happen without accompanying charges. This case may not have been specifically about civil asset forfeiture, given Tyson Timbs’ guilty plea, but the state made it about it by refusing to acknowledge its incorporation of the Bill of Rights.

This may start a scramble by law enforcement to suss out just how much of the Bill of Rights their particular state has incorporated. Given the Supreme Court’s disdain for arguments to the contrary, pushing legal challenges to forfeiture programs uphill is a non-starter. This case was a 9-0 rout in favor of protecting Americans from excessive fines and fees — in this case taking the form of civil asset forfeiture. This hopefully will be the starting point for nationwide reform of these abusive programs.

Permalink | Comments | Email This Story

Techdirt.

Android Apps Slurp Excessive Data – InformationWeek

Android Apps Slurp Excessive Data
InformationWeek
That finding comes from a study conducted by South Korean antivirus vendor AhnLab, which scanned 178 "best rated" Android applications using its cloud-based Android security scanning service. All told, of the apps scanned, AhnLab found that 43%

and more »

“android security” – read more