“Business Next Interview” Information security team imitates the thinking of hackers and performs penetration test in order to know the enemies and know oneself

How serious are information security problems? According to a collaborated information security research report by the Consumers’ Foundation and Institute for Information Industry on consumer perception, 80.9% of the people think that information and communication technology security threats are becoming more and more severe every day. Also, 83.9% of the people think that enterprises or government related units should actively improve information security related mechanisms.

API loopholes lead to information security risks

There is news on information security leaks almost every week, and the latest victim was the social media app Instagram. Officials confirmed that hackers used the ID verification loophole of the Instagram API application interface to steal the phone numbers, Emails and contact information of users, and mainly focused on stars and celebrities etc. Hackers have stolen specific personal information of over 6 million Instagram users and created databases with this information, then sold them for U.S. $10 per entry; this caused great concerns about Instagram’s protection of personal information.

Most people might not really feel the impact of personal information being stolen from Instagram, but the fact is that these types of security attacks and defenses occur every day. For example, electronic payments that are closely related to everybody also have API loopholes. Currently electronic payments are bound to mobile phone numbers; however, thieves might change the preset mobile phone number through authorization verification loopholes so that banks will send the verification codes to the mobile phones of the thieves, and then they will use electronic payment to pay.

The two cases described above show that API has become a new threat for information security in recent years. According to the new ten major information security risks summarized by OWASP (The Open Web Application Security Project) in 2017, two of the newly added risks were related to API security. Gamania CloudForce’s information security advisor Zero Chen stated that as mobile internet access becomes popular, enterprises are in a hurry to develop Apps, but they neglected the protection measures for the API servers behind, resulting in APIs having security loopholes and causing hackers to acquire related information without going through ID verification. This allowed hackers to acquire user permissions or related sensitive information without passing ID verification.

Vulnerability Assessment V.S Penetration Test

Faced with the threats from hackers, what enterprises need to do is to improve their information security protection levels; besides the traditional vulnerability assessment, they must go deeper and have penetration tests performed. Zero explained that vulnerability assessment mainly relies on automated scanning software to detect existing security loopholes, but it cannot detect newest security loopholes or logical thinking related loopholes and provide repair recommendations. Penetration tests on the other hand, will have professional information security teams imitate the thinking of hackers, and actually understand the operation modes of enterprises and the logic of their system architectures to perform tests, using real combat to locate any possibilities to break through the current website security protection and acquire internal assets or information of enterprises. By doing so, the team can find out where the logic of the system architecture is incomplete or other loophole risks, and help customers set up more complete and safer defense measures.

Zero further explained that penetration test is to have information security experts or hackers with moral conscience (also known as white hat hackers) hypothesize methods and strategies that hackers will use to penetrate inside enterprises, and use their professional skills to carefully check the system architecture of the enterprise to see if there are any unknown vulnerabilities or logical errors in their operation procedures, and help improve the system to strengthen security. If a health check is used as an analogy, vulnerability assessment is to use instruments to check the condition of the body; symptoms that are currently showing can be found, but there are no physicians to treat them. With penetration tests, not only can it perform in-depth analysis and detection of items that average health checks cannot check, it also helps treat and improve the symptoms. It can even provide accurate treatments and improvement recommendations based on the physique and symptoms of each patient.

Using penetration tests to locate potential problems behind websites

Take the penetration test for electronic payment commerce websites for example, Gamania CloudForce’s information security team will think of possible points that hackers might intrude based on the operational logic of the entire e-commerce system. First, analysis will be performed on the website architecture, management process, and business operation modes; for example how does the shopping system work, the order backstage database system, who they cooperated with for cash flow, which credit cards can be used or special payment modes etc., and the logical problems of outsourced and self-created programs, as well as social engineering loopholes that may occur from employees with backstage management. Different types of hacker threats are simulated to perform actual attacks and testing to find potential problems of the website system, and analyses and testing are performed from an overall macro perspective to confirm whether the customer’s website has potential problems and need to strengthen their security.

Besides websites, penetration test personnel will also use post-APT penetration test and start to acquire the user permissions of enterprise colleagues starting from the top of the enterprise; for example, send Emails with social engineering viruses or use the Email accounts of other employees, and use methods such as password cracking to acquire management permissions and get confidential information from the database server. It can also check whether the design of the overall information security defense architecture is complete, and whether the website firewalls or intrusion prevention system have filtered or raised alarms. Zero thinks that system architectures are designed by people; so, the fact is that all information security problems are people’s problems because the pursuit of convenience is human nature, but convenience and security contradict one another. So how can balance be reached between security and convenience in order to enjoy information convenience with the prerequisite of ensuring information security?

Currently, government agencies, financial industries, e-commerce, and gaming industries are having penetration tests performed more actively. Zero thinks that every industry needs penetration tests performed; once the enterprise website interacts with consumers and hackers can sell the personal information of customers, or that hackers can benefit from the operational values of the enterprise itself, they all need penetration tests performed to improve the information security standard of the enterprise to a maximum in order to reduce the risks of being hacked.

Currently many white hat hacker laboratories are training students to analyze the attack and defense methods of hackers, and then penetrate enterprise networks to perform actual attacks in order to find loopholes during the penetration process and propose recommendations. Gamania CloudForce held a “Hacker thinking penetration test” information security forum on the afternoon of September 14th, and invited professional lecturers on information security, including the general coordinator of the HITCON Community, who is also the CEO of DEVCORE, Allen Own, the assistant professor of the Department of Electrical and Electronic Engineering, Chung Cheng Institute of Technology, National Defense University, professor Ko-Chin Chang, and the lecturer who once won the Golden Shield Award for Information Security Skills and also the lecturer for OWASP 2017 Taiwan Day, Wayne Tseng to share how to think about the methods and tactics used by hypothetical enemies, allowing you to take a look at how white hat hackers perform penetration tests, finding unknown vulnerabilities by knowing the enemies and knowing oneself and becoming victorious.