Attackers can sniff or modify the sensitive data in web applications and APIs if not properly protected. Attack can lead to leak of financial data, usernames and passwords, or health information that could enable attackers to access such information to commit fraud or steal identities. One popular method for stealing sensitive information is using a man-in-the-middle (MITM) attack.

Sensitive Data Exposure

Introduction

Attackers can sniff or modify the sensitive data in web applications and APIs if not properly protected. Attack can lead to leak of financial data, usernames and passwords, or health information that could enable attackers to access such information to commit fraud or steal identities. One popular method for stealing sensitive information is using a man-in-the-middle (MITM) attack.

Responsibility

The responsibility of sensitive data exposure can be the fault of a user (if they were a victim of a phishing attack) or the fault of the company (if they underwent a data breach). There are a lot of gray areas as well in which both the parties can be held mutually responsible.

Few attack scenarios in which the provider (company) can be held liable

• Sensitive data such as username password is stored unencrypted
• Broken authentication or access control
• Attacks in which almost no user interaction is required

Few attack scenarios in which the consumer (user) can be held liable

• Phishing attack from a fake domain
• Using an insecure network
• Using an unsafe device

Prevention

It is important for both the user as well as the provider to protect themselves from sensitive data exposures. Below are a few preventive measures that can be taken

Provider side protection

• Encrypt with high level encryptions only
  One of the mistakes many of the developers do is they encrypt with weak algorithms like ROT13 etc.
  DO NOT ENCRYPT WITH SUCH WEAK ALGORITHMS

• Encrypt all pages
  Most of the times the pages are interlinked,and an attacker might use the ‘unsecured’ webpage to gain access to sensitive data.

• Encrypt all databases
  Encrypt the database as a whole or a column storing sensitive information.
  

  Username	Password
  John	MyPassword
  Annie	AnNie123
  Jack	PatriotismIsLife

  ^{Example of an unencrypted databse}
  
  

  Username	Password
  John	dc1e7c03e162397b355b6f1c895d…
  Annie	662dcb2ddf1cd7f7d002e97b7301…
  Jack	3c23e1b4cd65a4f19be3041889d8…

  ^{Encrypting the password field}

• See which data is sensitive
  Do not waste your time heavily encrypting databases whose information is not sensitive/important.
  eg. You need not heavily encrypt a database having only the date the user joined the platform

• Use HTTPS
  HTTPS encrypts the packets being sent between the server and user. This helps in preventing sniffing attacks.

• Do not store all data forever
  Keep a notice on your website “Accounts that are not active for __ days minimum will be deleted”
  This helps remove unnecessary data of inactive users which will minimize the damage of any attack that happens.

• Do not ask for unnecessary information
  The less data you have, the less you can lose. If you have made a website where people can chat, there may be no need to store their physical address while creating an account.

Consumer side protection

• Keep complex passwords
  Make sure to set complex passwords which can not be guessed.
• Phishing
  Make sure to double check the domain before typing in any information.
• Secure devices and network
  Make sure the devices you use to access the resources are secure and the network you are using to connect is known and trusted with a proper encryption protocol in place.

Conclusion

The above vulnerabilities are one of the most common and are complex to detect and solve even though a few measures are scenarios are elaborated above, various other types of bugs may effect the code leading to the above vulnerability. One must always be alert and mindful while programming or using applications.