Penetration Test Report (Veracode): Veracode   GlobaLeaks and Tor2web

Veracode Detailed Report
Application Security Report
As of 6 Feb 2014
Prepared for: Radio Free Asia
Prepared on: March 14, 2014
Application: GlobaLeaks
Industry: Not Specified
Business Criticality: BC4 (High)
Required Analysis: Static
Type(s) of Analysis Conducted: Manual
Inside This Report
Executive Summary 1
Summary of Flaws by Severity 1
Action Items 1
Flaw Types by Category 3
Policy Summary 5
Findings & Recommendations 6
Manual Flaw Details
Methodology
While every precaution has been taken in the preparation of this document, Veracode, Inc. assumes no responsibility for errors, omissions, or for
damages resulting from the use of the information herein. The Veracode platform uses static and/or dynamic analysis techniques to discover
potentially exploitable flaws. Due to the nature of software security testing, the lack of discoverable flaws does not mean the software is 100%
secure.
© 2014 Veracode, Inc. Radio Free Asia and Veracode Confidential
65 Network Drive, Burlington, MA 01803 Tel.[PII_REDACTED] Fax.[PII_REDACTED] URL:http://www.veracode.com
Veracode Detailed Report Veracode Level: VL2
Application Security Report Rated: Feb 6, 2014
As of 6 Feb 2014
Application: GlobaLeaks Business Criticality: High
Target Level: VL4 Published Rating: A
Scans Included in Report
Static Scan Dynamic Scan Manual Scan
Not Included in Report Not Included in Report Jan 2014 Manual Results
Score: 92
Completed: 2/6/14
Executive Summary
This report contains a summary of the security flaws identified in the application using automated static, automated dynamic and/or
manual security analysis techniques. This is useful for understanding the overall security quality of an individual application or for
comparisons between applications.
Application Business Criticality: BC4 (High)
Impacts:Operational Risk (Medium), Financial Loss (Medium)
An application's business criticality is determined by business
risk factors such as: reputation damage, financial loss,
operational risk, sensitive information disclosure, personal safety,
and legal violations. The Veracode Level and required
assessment techniques are selected based on the policy
assigned to the application.
Analyses Performed vs. Required
ynA
citatS
cimanyD
launaM
Veracode Detailed Report prepared for Radio Free Asia – Mar 14, 2014
Summary of Flaws Found by Severity
Performed:
Required:
Action Items:
Veracode recommends the following approaches ranging from the most basic to the strong security measures that a vendor can
undertake to increase the overall security level of the application.
Required Analysis
Your policy requires Static Scan but it has not been performed. Please submit your application for Static Scan and
remediate the required detected flaws to conform to your assigned policy.
Flaws To Fix By Expires Date
A grace period is specified for any flaw that violates the rules contained in your policy. These include CWE, Rollup Category, Issue
Severity, Industry Standards as well as any flaws the prevent an application from achieving a minimum Veracode Level and/or score.
To maintain policy compliance you must fix these flaws and resubmit your application for scanning before the grace period expires.
The detailed flaw listing will badge the flaws that must be fixed and show the fix by date as well.
The grace period has expired [2/6/14] for 2 flaws that were found in your Manual Scan.
Longer Timeframe (6 - 12 months)
© 2014 Veracode, Inc. Radio Free Asia and Veracode Confidential
65 Network Drive, Burlington, MA 01803 1 Tel.[PII_REDACTED] Fax.[PII_REDACTED] URL:http://www.veracode.com
Veracode Detailed Report prepared for Radio Free Asia – Mar 14, 2014
Certify that software engineers have been trained on application security principles and practices.
© 2014 Veracode, Inc. Radio Free Asia and Veracode Confidential
65 Network Drive, Burlington, MA 01803 2 Tel.[PII_REDACTED] Fax.[PII_REDACTED] URL:http://www.veracode.com
Veracode Detailed Report prepared for Radio Free Asia – Mar 14, 2014
Flaw Types by Severity and Category
Manual Scan
Security Quality Score =
92
Very High 0
High 0
Medium 2
Other 2
Low 6
Cryptographic Issues 5
Information Leakage 1
Very Low 0
Informational 3
Insecure Dependencies 3
Total 11
© 2014 Veracode, Inc. Radio Free Asia and Veracode Confidential
65 Network Drive, Burlington, MA 01803 3 Tel.[PII_REDACTED] Fax.[PII_REDACTED] URL:http://www.veracode.com
Veracode Detailed Report prepared for Radio Free Asia – Mar 14, 2014
Manual Penetration Test Summary Findings
Below is a summary of vulnerabilities found as categorized by CAPEC. A score of 100 indicates that no vulnerabilities were discovered
under that attack category.
Attack Category Score (out of 100)
Abuse of Functionality
Exploitation of business logic errors or misappropriation of programmatic resources. Application 59
functions are developed to specifications with particular intentions, and these types of attacks
serve to undermine those intentions.
Spoofing
Impersonation of entities or trusted resources. A successful attack will present itself to a verifying 100
entity with an acceptable level of authenticity.
Probabilistic Techniques
Using predictive capabilities or exhaustive search techniques in order to derive or manipulate 100
sensitive information. Attacks capitalize on the availability of computing resources or the lack of
entropy within targeted components.
Exploitation of Authentication
Circumventing authentication requirements to access protected resources. Design or 100
implementation flaws may allow authentication checks to be ignored, delegated, or bypassed.
Resource Depletion
Affecting the availability of application components or resources through symmetric or asymmetric
consumption. Unrestricted access to computationally expensive functions or implementation flaws 100
that affect the stability of the application can be targeted by an attacker in order to cause denial of
service conditions.
Exploitation of Privilege/Trust
Undermining the application's trust model in order to gain access to protected resources or gain 100
additional levels of access as defined by the application. Application that implicitly extend trust to
resources or entities outside of their direct control are susceptible to attack.
Injection (Injecting Control Plane content through the Data Plane)
Inserting unexpected inputs to manipulate control flow or alter normal business processing. 100
Applications must contain sufficient data validation checks in order to sanitize tainted data and
prevent malicious, external control over internal processing.
Data Structure Attacks
Supplying unexpected or excessive data that results in more data being written to a buffer than it is 100
capable of holding. Successful attacks of this class can result in arbitrary command execution or
denial of service conditions.
Data Leakage Attacks
Recovering information exposed by the application that may itself be confidential or may be useful
to an attacker in discovering or exploiting other weaknesses. A successful attack may be 86
conducted by passive observation or active interception methods. This attack patter often
manifests itself in the form of applications that expose sensitive information within error messages.
Resource Manipulation
Manipulating application dependencies or accessed resources in order to undermine security 100
controls and gain unauthorized access to protected resources. Applications may use tainted data
when constructing paths to local resources or when constructing processing environments.
Time and State Attacks
Undermining state condition assumptions made by the application or capitalizing on time delays
between security checks and performed operations. An application that does not enforce a 100
required processing sequence or does not handle concurrency adequately will be susceptible to
these attack patterns.
© 2014 Veracode, Inc. Radio Free Asia and Veracode Confidential
65 Network Drive, Burlington, MA 01803 4 Tel.[PII_REDACTED] Fax.+