Insecure indexing

A Seminar on

Insecure IndexingInsecure IndexingDepartment of I.T.

Rajasthan Institute of Engineering & Technology, Jaipur

Presented By: Yogendra SinghPresented By: Yogendra Singh

What is Indexing?

Why is it important?

Indexing mechanisms used to speed up access to desired data.E.g., author catalog in library

Search Key - attribute to set of attributes used to look up records in a file.

An index file consists of records (called index entries) of the form.

Index files are typically much smaller than the original file

Insecure Indexing is a threat to the data confidentiality of the web-site.

Indexing web-site contents via a process that has access to files which are not supposed to be publicly accessible has the potential of leaking information about the existence of such files, and about their content. 

 In the process of indexing, such information is collected and stored by the indexing process, which can later be retrieved by a determined attacker, typically through a series of queries to the search engine.

The attacker does not thwart the security model of the search engine.

•  Locate the search facility manually, and using the above technique and the search facility, construct a list of all indexed files. Compare that to a list of all visible sitesIf there are indexed files which are not visible, then the site is vulnerable. This is black box method.

• If there's access to the host itself , then a test can consist of adding a new file to an indexable folder, with unique content , and then querying the search engine for this string . If the string is found, then the site is vulnerable .

Suppose the attacker suspects that vendor X is about to publish a security advisory on their website. Also suppose that the attacker knows that part of the publishing process, the file is uploaded to the website few days (or weeks) before the advisory is published. The file resides on the web server, yet it is not linked from anyplace. Further suppose that the file name is unpredictable. Assuming that the site operates a search engine that *locally* indexes server *files*, and that it has recently indexed the site (so it encountered the advisory file as well), the attacker can now guess a word or two that are likely to appear in an advisory (e.g. maybe "Vendor X advisory X-Adv-07-"), and with luck, the search engine will display a URL to the unpublished advisory. And if the site is really insecure, the URL will be downloadable by the attacker.

Local search engines that use file-level access may pose a security hazard (insecure indexing) due to their access to resources which are not accessible to remote users. By indexing those resources, the search engine creates a channel through which data may be leaked to remote users.

crawling style indexing should be preferred over direct file indexing. 

Thank You!