Low-level Vulnerabilities Research Articles

Uncovering the Risk of Academic Information System Vulnerability through PTES and OWASP Method

The security of academic information systems needs consideration to anticipate various threats, resulting in data leakage, misuse of information, modification, and data destruction. There are 36 public and private universities that utilize the academic information system provided by the software developed by Company XYZ. Limited resources in universities contribute to the weak handling of vulnerabilities in academic information systems. The research aims to determine the vulnerability level of academic information systems developed by Company XYZ through penetration testing. The research employs a deductive approach to explore academic system vulnerabilities based on incidents related to system security issues at a university. The research utilizes a combination of two testing methods: Penetration Testing Execution Standard (PTES) and Open Web Application Security Project (OWASP), chosen for their reliability, ease of use, and support by penetration testing tools. Penetration testing follows the PTES, involving seven steps: pre-engagement interaction, information collection, threat modeling, vulnerability analysis, exploitation, postexploitation, and reporting. The threat focus in the research aligns with the top 10 of 2021 OWASP, ranking the ten most critical security risks. Results reveal eight critical security issues based on measurements using the Common Vulnerability Scoring System (CVSS) method. There are two high-level vulnerabilities, five medium-level vulnerabilities, and one low-level vulnerability. Moreover, the three principal vulnerabilities are Structured Query Language (SQL) Injection, broken access control, and weak encryption. Universities can enhance data integrity by independently remediating vulnerabilities discovered in the research. Furthermore, universities are encouraged to raise awareness within the academic community regarding the security of academic data.

Analysis of Higher Education SIAKAD Website Security Gaps Using the Vulnerability Assessment Method

SIAKAD is a website-based application designed to facilitate academic management and academic activities by universities. The SIAKAD system contains sensitive and important information from lecturers and students such as personal, academic, and financial information. Seeing the importance of information security, universities must be able to ensure that their SIAKAD is protected by a strong and reliable security system. To find out threats that can be exploited by hackers, it is necessary to analyze security holes in a system. The research procedure was carried out through (1) Terminal, Zenmap, Whois, Wappalyzer as tools for foot printing or data collection, (2) OWASP ZAP as a tool for conducting Vulnerability Scanning. The results of this study revealed that there were 11 vulnerabilities found, consisting of 5 medium vulnerability levels and 6 low level vulnerabilities. In addition, to deal with these vulnerabilities, this research also discusses solutions that can be alternatives for increasing information security in higher education SIAKAD.

Measuring and Profiling Social Vulnerability to Natural Disaster in Indonesia in 2019

Nowadays, natural hazards are often seen from the nature perspective only. However, it is necessary to know not only about the hazards, but also the community resilience to prepare for, respond to, and recover from disasters based on the social characteristics which are called social vulnerability. This study provides the identification of social vulnerability to natural hazards condition and characterization of the dominant factors at the district level in Indonesia using secondary data. The principal component analysis (PCA) is used to reduce 13 district-level variables into 4 components that represents the driving factors of social vulnerability. The results of PCA are used to quantify the social vulnerability level of the districts in Indonesia using social vulnerability index (SoVI), followed by the deeper exploration of social vulnerability problem using K-Means Clustering. The SoVI and cluster results were mapped by using QGIS to identify the social vulnerability at districts level. The research shows that most districts in Indonesia are at a low-level vulnerability. The districts with low vulnerability are spread in the Sumatera and Kalimantan area. However, there are 43 Districts in Eastern Indonesia are in a high-level vulnerability. These districts also suffer many problems, such low sosioeconomic status. The results of this study support not only the previous social vulnerability studies but also the government as the policymakers by setting priority regions and allocating the policies according to main social vulnerability problem of each district, especially in the most vulnerable regions.

Vulnerability Assessment and Penetration Testing On The Xyz Website Using Nist 800-115 Standard

Currently the website has become an effective communication tool. However, it is essential to have vulnerabilities assessment and penetration testing using specific standards on released websites to the public for securing information. The problems raised in this research are conducting vulnerability testing on the XYZ website to analyze security gaps in the XYZ website, as well as conducting penetration testing on high vulnerabilities found. Testing was conducted using the NIST 800 – 115 Standard through 4 main stages: planning, discovery, attack, and report. Several tools were used: Nmap, OWASP ZAP, Burp Suite, and Foxy Proxy. This research results are presented and analyzed. There were seven vulnerabilities found, one high-level vulnerability, two medium-level vulnerabilities, and four low-level vulnerabilities. At the high level, SQL Injection types are found, at the medium level, Cross-Domains Misconfiguration and vulnerabilities are found, at the low level, Absence of Anti-CSRF Tokens, Incomplete or No Cache-control and Pragma HTTP Header Set, Server Leaks Information via “X-Powered-By” HTTP Response Header Field and X-Content-Type-Options Header Missing are found.

Stack Redundancy to Thwart Return Oriented Programming in Embedded Systems

With the emergence of Internet of Things, embedded devices are increasingly the target of software attacks. The aim of these attacks is to maliciously modify the behavior of the software being executed by the device. The work presented in this letter has been developed for the Cyber Security Awareness Week Embedded Security Challenge. This contest focuses on memory corruption issues, such as stack overflow vulnerabilities. These low level vulnerabilities are the result of code errors. Once exploited, they allow an attacker to write arbitrary data in memory without limitations. We detail in this letter a hardware-based countermeasure against return address corruption in the processor stack. First, several exploitation techniques targeting stack return addresses are discussed, whereas a lightweight hardware countermeasure is proposed and validated on the OpenRISC core. The countermeasure presented follows the shadow stack concept with a minimal hardware modification of the targeted core and an easy integration at the application level.