Common Security Vulnerabilities Research Articles

An automated framework for detecting and mitigating memory safety vulnerabilities in uefi firmware

An automated framework for detecting and mitigating memory safety vulnerabilities in uefi firmware

Mitigating Default Password Risks in CCTV: A Qualitative Study to Guide Recommendations for Device Makers

The rapid growth of Internet of Things (IoT) devices has brought unmatched convenience, connectivity, and significant cybersecurity issues. One of IoT devices' predominant security risks is default passwords, making them vulnerable to various attacks and exploits. CCTV is highly susceptible to security breaches due to the reliance on default passwords. This paper identifies the risks associated with default passwords in CCTV and explores how they can be mitigated. Qualitative research was conducted to achieve this. Qualitative data was gathered through interviews with security experts, manufacturers, and CCTV end-users, and thematic analysis was subsequently analyzed. Through the research, the authors identified common security vulnerabilities and risks linked to default passwords in CCTV and employed password policies and authentication protocols. They recommended best practices to mitigate these risks. The results of this study have significant consequences for the area of IoT security, offering a broad understanding of the risks linked to default passwords in IoT devices, identifying optimal practices for mitigating them, and contributing valuable observations to more comprehensive discussions on IoT security. Eventually, the overarching goal of this study is to increase the safety and privacy of both individuals' and organizations' IoT devices and promote liable and ethical use of this technology.

Common Security Vulnerabilities in Android Apps: a Comprehensive Guide

Common Security Vulnerabilities in Android Apps: a Comprehensive Guide

A Dynamic Behavior Verification Method for Composite Smart Contracts Based on Model Checking

A composite smart contract can execute smart contracts that may belong to other owners or companies through external calls, bringing more security challenges to blockchain applications. Traditional static verification methods are inadequate for analyzing the dynamic execution of these contracts, resulting in misjudgment and omission issues. Therefore, this paper proposes a model checking approach based on dynamic behavior that verifies the security and business logic of composite smart contracts. Utilizing automata, the method models contracts, users, attackers, and extracts properties, focusing on six types of common security vulnerabilities. A thorough case study and experimental evaluation demonstrate the method’s efficiency in identifying vulnerabilities and ensuring alignment with business requirements. The UPPAAL tool is employed for comprehensive verification, proving its effectiveness in enhancing smart contract security.

Evaluation of Common Security Vulnerabilities of State Universities and Colleges Websites Based on OWASP

The security of state universities' and colleges' websites in the Philippines is vital because they play a critical role in delivering education and information to a wide variety of users. However, these institutions are also exposed to several security flaws due to their growing reliance on digital platforms. The objective of this study is to analyze security vulnerabilities in state universities and colleges websites, utilizing the OWASP Zed Attack Proxy (ZAP), an open-source tool. By adhering to the Open Web Application Security Project (OWASP) Top 10, we can identify potential hazards and suggest appropriate measures to mitigate risks. The steps of the test include gathering data about the test target, using OWASP ZAP to do automatic scanning, exploitation of the scan results, reporting, and offering recommendations. Seventeen (17) SUCs were examined, and the results show that 23.53% are vulnerable to injection, 40.06% had insecure design, 70.59% had outdated components, 88.24% have security misconfiguration, and 94.12% are vulnerable to Broken Access Control. Malicious actors use these vulnerabilities to obtain unauthorized access to software, networks, and systems. By raising the privileges and granting the user ID additional access inside the ecosystem, it can harm the availability, confidentiality, or integrity of data. SUCs should embrace the OWASP Top 10 and begin the process of ensuring that the risks associated with their websites are minimized.

Comprehensive Empirical Study of Python JWT Libraries

Comprehensive Empirical Study of Python JWT Libraries

Detection of Vulnerabilities of Blockchain Smart Contracts

With the wide application of IoT and blockchain, research on smart contracts has received increased attention, and security threat detection for smart contracts is one of the main focuses. This paper first introduces the common security vulnerabilities in blockchain smart contracts, and then classifies the vulnerabilities detection tools for smart contracts into six categories according to the different detection methods: formal verification method, symbol execution method, fuzzy testing method, intermediate representation method, stain analysis method and deep learning method. We test 27 detection tools, and analyze them from several perspectives, including the capability of detecting a smart contract version. Finally, it is concluded that most of the current vulnerability detection tools can only detect vulnerabilities in a single and old version of smart contracts. Although the deep learning method detects fewer types of smart contract vulnerabilities, it has higher detection accuracy and efficiency. Therefore, the combination of static detection methods such as deep learning method and dynamic detection methods including the fuzzy testing method to detect more types of vulnerabilities in multi-version smart contracts to achieve higher accuracy is a direction worthy of research in the future.

Theory and practice in secure software development lifecycle: A comprehensive survey

Software development security refers to the practice of integrating security measures and considerations throughout the software development lifecycle to ensure the confidentiality, integrity, and availability of software systems. It involves identifying, mitigating, and eliminating security vulnerabilities and threats that could be exploited by attackers. The goal of this paper is to survey the various concepts and methodologies directed towards software security, and the identification of any missing gaps. Based on the findings, it is noted that the development of secure software requires a proactive and comprehensive approach. It begins with establishing secure design principles and incorporating security requirements from the initial stages of development. Here, secure coding practices, such as input validation, output encoding, and secure authentication and authorization mechanisms, are employed to prevent common security vulnerabilities. In addition, regular security testing, including penetration testing and vulnerability scanning, helps identify and address potential weaknesses in the software. Normally, code reviews and security audits are conducted to ensure adherence to secure coding practices and identify any security flaws. It is important that security training and awareness programs be provided to developers and other stakeholders to foster a security-conscious culture. To minimize potential vulnerabilities, secure configuration management, which involves properly configuring servers, networks, and dependencies may be utilized. On the other hand, regular updates and patching are essential to address known security vulnerabilities in software components. To guide their software development security practices, organizations may follow established security standards and frameworks such as ISO 27001 or NIST Cybersecurity Framework. By prioritizing software development security, organizations can protect sensitive data, prevent unauthorized access, and mitigate the risk of security breaches and incidents. In the long run, this helps build trust with users and stakeholders, enhances the reputation of the software, and reduces the potential impact of security incidents on the organization.

Modernizing the Legacy Healthcare System to Decentralize Platform Using Blockchain Technology

The use of blockchain technology is expanding in various industries, including finance, supply chain management, food, energy, IoT, and healthcare. The article aims to address the challenges of complex medical procedures, large-scale medical data management, and cost optimization in the healthcare industry. By employing blockchain technology, the article aims to enhance data security and privacy while ensuring the integrity and efficiency of the healthcare system. This article focuses on the application of blockchain technology in the healthcare system by reviewing the existing literature and proposing multiple workflows for better data management. These workflows were implemented using the Ethereum blockchain platform and involve complex medical procedures such as surgery and clinical trials, as well as managing a large amount of medical data. The feasibility of the proposed system is analyzed in terms of associated costs, and a model-driven engineering approach is used to recover the architecture of traditional healthcare systems. The aim is to provide stakeholders in the healthcare system with better healthcare services and cost optimization. The solution being proposed automates interactions between different parties involved. Smart contracts were created using Solidity language, and their functions were tested using the Remix IDE. This paper illustrates that our smart contract code was designed to avoid common security vulnerabilities and attacks. To test the framework, a prototype of the smart contract was deployed on an Ethereum TESTNET blockchain in a Windows environment. This study found that the proposed approach is both practical and efficient.

Utilizing Object Capabilities to Improve Web Application Security

Nowadays, more and more applications are built with web technologies like HTML, CSS, and JavaScript, which are then executed in browsers. The web is utilized as an operating system independent application platform. With this change, authorization models change and no longer depend on operating system accounts and underlying access controls and file permissions. Instead, these accounts are now implemented in the applications themselves, including all of the protective measures and security controls that are required for this. Because of the inherent complexity, flaws in the authorization logic are among the most common security vulnerabilities in web applications. Most applications are built on the concept of the Access-Control List (ACLs), a security model that decides who can access what object. Object Capabilities, transferable rights to perform operations on specific objects, have been proposed as an alternative to ACLs, since they are not susceptible to certain attacks prevalent for ACLs. While their use has been investigated for various domains, like smart contracts, they have not been widely applied for web applications. In this paper, we therefore present a general overview of the capability based authorization model and adapt those approaches for use in web applications. Based on a prototype implementation, we show the possibilities of Object Capabilities to enhance security, but also provide insights on existing pitfalls and problems in porting such models to the web domain.

Blockchain-Enabled Decentralized Secure Big Data of Remote Sensing

Blockchain technology has emerged as a promising candidate for space exploration and sustainable energy systems. This transformative technology offers secure and decentralized strategies to process and manipulate space resources. Remote sensing provides viable potential with the coexistence of open data from various sources, such as short-range sensors on unmanned aerial vehicles (UAVs) or Internet-of-Things (IoT) tags and far-range sensors incorporated on satellites. Open data resources have most recently emerged as attractive connecting parties where owners have shown consent to share data. However, most data owners are anonymous and untrustworthy, which makes shared data likely insecure and unreliable. At present, there are several tools that distribute open data, serving as an intermediate party to link users with data owners. However, these platforms are operated by central authorities who develop guidelines for data ownership, integrity, and access, consequently restricting both users and data owners. Therefore, the need and feasibility of a decentralized system arise for data sharing and retrieving without involving these intermediate limiting parties. This study proposes a blockchain-based system without any central authority to share and retrieve data. Our proposed system features (i) data sharing, (ii) maintaining the historical data, and (iii) retrieving and evaluation of data along with enhanced security. We have also discussed the use of blockchain algorithms based on smart contracts to track space transactions and communications in a secure, verifiable, and transparent manner. We tested the suggested framework in the Windows environment by writing smart contracts prototype on an Ethereum TESTNET blockchain. The results of the study showed that the suggested strategy is efficient, practicable, and free of common security attacks and vulnerabilities.

Research and application of next-generation firewall technique in medical network

With the rapid development of medical informatization as well as the larger quantities of information and higher integration level, it has become a severe challenge to keep the core data confidential. In this thesis, the role of next-generation firewall in the medical network has been first introduced. Then, a medical network has been designed and an overall network building scheme aimed at the medical network has been planned based on the actual demand of a hospital. Then, VLAN has been divided and IP address has been planned to each floor. Moreover, relevant protocols and important equipment to be used have been introduced in detail, including DHCP protocol, SNMP protocol, next-generation firewall safety devices. In addition, the IP address of each area has been planned, the connectivity of LAN has been tested and the simulated attack and defense test has been taken based on the deployment principle of next-generation firewall. Furthermore, a detailed introduction of deployment of security policy as well as some common security vulnerabilities on firewall has been made. At last, the attack and defense test of firewall has been taken to prove the efficient protection function of firewall in the medical network and meanwhile prove that next-generation firewall technique could help the hospital solve the network security issues to some extent.

OAuth 2.0 : Architectural design augmentation for mitigation of common security vulnerabilities

OAuth 2.0 : Architectural design augmentation for mitigation of common security vulnerabilities

Directed Test Generation for Activation of Security Assertions in RTL Models

Assertions are widely used for functional validation as well as coverage analysis for both software and hardware designs. Assertions enable runtime error detection as well as faster localization of errors. While there is a vast literature on both software and hardware assertions for monitoring functional scenarios, there is limited effort in utilizing assertions to monitor System-on-Chip (SoC) security vulnerabilities. We have identified common SoC security vulnerabilities and defined several classes of assertions to enable runtime checking of security vulnerabilities. A major challenge in assertion-based validation is how to activate the security assertions to ensure that they are valid. While existing test generation using model checking is promising, it cannot generate directed tests for large designs due to state space explosion. We propose an automated and scalable mechanism to generate directed tests using a combination of symbolic execution and concrete simulation of RTL models. Experimental results on diverse benchmarks demonstrate that the directed tests are able to activate security assertions non-vacuously.

Security issues and framework of electronic medical record: A review

The electronic medical record has been more widely accepted due to its unarguable benefits when compared to a paper-based system. As electronic medical record becomes more popular, this raises many security threats against the systems. Common security vulnerabilities, such as weak authentication, cross-site scripting, SQL injection, and cross-site request forgery had been identified in the electronic medical record systems. To achieve the goals of using EMR, attaining security and privacy is extremely important. This study aims to propose a web framework with inbuilt security features that will prevent the common security vulnerabilities in the electronic medical record. The security features of the three most popular and powerful PHP frameworks Laravel, CodeIgniter, and Symfony were reviewed and compared. Based on the results, Laravel is equipped with the security features that electronic medical record currently required. This paper provides descriptions of the proposed conceptual framework that can be adapted to implement secure EMR systems.

Cyber Security Threats and Vulnerabilities: A Systematic Mapping Study

There has been a tremendous increase in research in the area of cyber security to support cyber applications and to avoid key security threats faced by these applications. The goal of this study is to identify and analyze the common cyber security vulnerabilities. To achieve this goal, a systematic mapping study was conducted, and in total, 78 primary studies were identified and analyzed. After a detailed analysis of the selected studies, we identified the important security vulnerabilities and their frequency of occurrence. Data were also synthesized and analyzed to present the venue of publication, country of publication, key targeted infrastructures and applications. The results show that the security approaches mentioned so far only target security in general, and the solutions provided in these studies need more empirical validation and real implementation. In addition, our results show that most of the selected studies in this review targeted only a few common security vulnerabilities such as phishing, denial-of-service and malware. However, there is a need, in future research, to identify the key cyber security vulnerabilities, targeted/victimized applications, mitigation techniques and infrastructures, so that researchers and practitioners could get a better insight into it.

Smart Contract Security: A Software Lifecycle Perspective

Smart contract security is an emerging research area that deals with security issues arising from the execution of smart contracts in a blockchain system. Generally, a smart contract is a piece of executable code that automatically runs on the blockchain to enforce an agreement preset between parties involved in the transaction. As an innovative technology, smart contracts have been applied in various business areas, such as digital asset exchange, supply chains, crowdfunding, and intellectual property. Unfortunately, many security issues in smart contracts have been reported in the media, often leading to substantial financial losses. These security issues pose new challenges to security research because the execution environment of smart contracts is based on blockchain computing and its decentralized nature of execution. Thus far, many partial solutions have been proposed to address specific aspects of these security issues, and the trend is to develop new methods and tools to automatically detect common security vulnerabilities. However, smart contract security is systematic engineering that should be explored from a global perspective, and a comprehensive study of issues in smart contract security is urgently needed. To this end, we conduct a literature review of smart contract security from a software lifecycle perspective. We first analyze the key features of blockchain that can cause security issues in smart contracts and then summarize the common security vulnerabilities of smart contracts. To address these vulnerabilities, we examine recent advances in smart contract security spanning four development phases: 1) security design; 2) security implementation; 3) testing before deployment; and 4) monitoring and analysis. Finally, we outline emerging challenges and opportunities in smart contract security for blockchain engineers and researchers.

Towards Model Checking Android Applications

As feature-rich Android applications (apps for short) are increasingly popularized in security-sensitive scenarios, methods to verify their security properties are highly desirable. Existing approaches on verifying Android apps often have limited effectiveness. For instance, static analysis often suffers from a high false-positive rate, whereas approaches based on dynamic testing are limited in coverage. In this work, we propose an alternative approach, which is to apply the software model checking technique to verify Android apps. We have built a general framework named DroidPF upon Java PathFinder (JPF), towards model checking Android apps. In the framework, we craft an executable mock-up Android OS which enables JPF to dynamically explore the concrete state spaces of the tested apps; we construct programs to generate user interaction and environmental input so as to drive the dynamic execution of the apps; and we introduce Android specific reduction techniques to help alleviate the state space explosion. DroidPF focuses on common security vulnerabilities in Android apps including sensitive data leakage involving a non-trivial flow- and context-sensitive taint-style analysis. DroidPF has been evaluated with 131 apps, which include real-world apps, third-party libraries, malware samples and benchmarks for evaluating app analysis techniques like ours. DroidPF precisely identifies nearly all of the previously known security issues and nine previously unreported vulnerabilities/bugs.

An analysis of influence of safe programming techniques on applications efficiency and security

The topics covered in this article are the risks that must be taken into account when developing the software. This article gives you an overview of safeguards against some of the anticipated common security vulnerabilities. Based on the written programs, the impact of the various techniques of safe programming on the performance and security of the application has been analyzed. This article presents both a theoretical description of the protections as well as examples of their technical implementation.

Enhancement of Web Security Against External Attack

The security of web-based services is currently playing a vital role for the software industry. In recent years, many technologies and standards have emerged in order to handle the security issues related to web services. This paper shows techniques to enhance the security of web services, and some of the recent challenges and recommendations of a proposed model to secure web services. It shows the security process of a real life web application, which includes; HTML5 forms, login security, and a single signon solution. This paper also aim to discuss the ten (10) most common web security vulnerabilities and how to prevent the web application from three (3) of the vulnerabilities. Amongst them are; SQL Injection, Cross Site Scripting and Broken Authentication, and Session Management.