Definition
Cryptographic failures occur when encryption mechanisms meant to protect data are improperly implemented or weak, allowing unauthorized access. This includes weak algorithms, poor key management, and missing encryption, both at rest and in transit.How It Works
- 1Weak Algorithms: Algorithms like MD5, SHA1, or DES are outdated and can be easily cracked by attackers.
- 2Hardcoded Keys: Keys embedded directly in the source code can be extracted and misused by attackers.
- 3Missing Encryption: Data is transmitted or stored without encryption, making it accessible to anyone with network access.
- 4Improper Certificate Validation: Failing to properly validate SSL/TLS certificates can lead to man-in-the-middle attacks.
Key Characteristics
- Use of deprecated cryptographic algorithms
- Hardcoded or reused cryptographic keys
- Lack of encryption for sensitive data
- Inadequate certificate validation
Comparison
| Concept | Explanation |
|---|---|
| Cryptographic Failures | Weak or improperly implemented encryption practices |
| Broken Authentication | Flaws in the authentication process allowing unauthorized access |
| Security Misconfiguration | Incorrect security settings that expose vulnerabilities |
Real-World Example
The Adobe 2013 breach exposed millions of encrypted passwords using weak cryptography, while the Heartbleed vulnerability (CVE-2014-0160) exploited a flaw in OpenSSL that allowed sensitive data to be accessed in plaintext.Detection & Prevention
- Use tools like nmap or testssl to detect weak encryption
- Implement strong algorithms like AES-256 and SHA-256
- Use Burp Suite or OWASP ZAP for TLS/SSL testing
- Regularly update cryptographic libraries
Common Misconceptions
- 1All encryption is unbreakable: Weak algorithms can be easily cracked.
- 2SSL/TLS is always secure: Without proper certificate validation, it's vulnerable to attacks.
- 3Once encrypted, data is safe: Poor key management can still expose encrypted data.