Synopsis

Aspect performed a security architecture and code review on a strong authentication server being implemented by a chemical company.

The Client and the Application

The client is a major chemical company establishing a strong single sign-on solution for hundreds of complex intranet applications. The authentication server was built using Java and RSA SecureID tokens and deployed across the United States.

Why Did They Come to Aspect?

Aspect was selected for our extensive experience with Java security technology and proven capability to review the code of complex applications. This application is the lynchpin of the customer's intranet security, and demanded a high degree of assurance.

How Did We Work With Them?

The Aspect team worked onsite to evaluate the security of the authentication server. We worked directly with the team devleoping the application to capture and review the security architecture. After establishing a threat model for the application, we identified a prioritized list of areas to review in the implementation level review.

What Did We Find?

We found that almost all the code used positive validation and PreparedStatements to prevent SQL injection. However, some automatically generated code did not follow the pattern and was susceptible to these attacks. A successful attack by a motivated insider could have compromised the entire authentication scheme.

What Happened?

We met with the development team and demonstrated how the attack could compromise the database and their entire authentication scheme. The problem was relatively easy to fix by using PreparedStatements for all interaction with the database.