Tampering SPP protected fields would be possible if someone could correctly calculate a new checksum?

We create an Oracle Apex application for one of our customers.

ApEx 4.2.0.00.27, 11 2 GR database

(Hidden) elements are protected by the option of protection of the State of Session "required Checksum - level of the Session. This prevents tampering with the values that it self.

Security officers fear, however, that it might be possible to change the value of the element and recompute a checksum to match this value. And if the value of the element is the key to another line, this could mean to modify the data of another user.

In a response on the mechanism of control in tabular form (https://forums.oracle.com/message/5397831#5397831) the steps are described as follows:

  1. checksum (I) on the rank is calculated when rendering
  2. (II) checksum is calculated to verify the changes
  3. checksum (III) on the master data is calculated and compared to the checksum (I) ensure that the data has not been modified in the database.

If I apply this to the SSP-checksum I see the following steps:

  1. (I) checksum is calculated on the value of the element when rendering
  2. page is sent
  3. checksum (II) the data in the database is calculated and compared to the checksum (I) ensure that the value of the element has not been tampered with.

Now the scenario of security officers:

  1. someone finds a way to calculate the correct checksum for value a/all
  2. (I) checksum is calculated on the value of the element when rendering
  3. It replaces the value of the element "table_id" (1000) by another valid value "table_id" (900) and replaces the original checksum (I) with a correct checksum (II) to the new value.
  4. page is sent
  5. (III) checksum is calculated for the new "table_id" (900), this corresponds to the 'false' (II) checksum and the 900 line data are changed

If (and I think it is highly unlikely) someone would be able to calculate correct checksums, this scenario works? Or don't miss us something in our way of thinking?

Hi user600985,

If an attacker has a way to calculate correct checksums, this scenario could work. That being said, I think it's very theoretical. Checksum protection is a fundamental security and used concept in all sorts of web frameworks, not only the APEX. I am convinced that our implementation is at least as good as the others.

However, security can (and very often) be applied to all layers, not only the front-end server. For example, a layer below the URL / checksum point protection are the form and the process in the form of the APEX. You can add DURATION where clauses that APEX adds automatically when it retrieves rows or perform the insert/update / delete. They can be used to ensure that DML applies only to records that the user is allowed to see and edit. More below, you have access to (also known under the name of MEV) fine-grained, making something similar directly in the database. This is a characteristic of the company, but you can also emulate it on a level with views and triggers if you're on the standard edition. The last layer is a sound relational data model where the correct data types and constraints keep the integrity of the data. Depending on the complexity of an application, it is sometimes a good idea to add a layer of logic view/trigger on physical model, where the additional security checks are implemented.

Kind regards

Christian

Tags: Database

Similar Questions

Maybe you are looking for

  • No sound on Equium - driver corrupted or missing (Code 39)

    Hello My name is Fanta.I recently wanted to play music on my computer using windows media player, but no sound from the speakers of the laptop, I checked the Device Manager and there is a sign less next to the audio, video recorders and game when I s

  • microSD, microSDHC, adapters in the Lynx (K3011)

    Anyone know for sure if this tablets works with the 3 typse os microSD cards on the market today?

  • The W700 has a switchable graphics card?

    The GPU dedicated to the Integrated GPU? I have received conflicting information on this subject? I was told of any system is also switchable discrete graphics.

  • After System Restore

    Hi, I just had to use the system restore on my Win Vista (32-bit), looks like some games that I uninstalled appear as installed, when I try to uninstall it, I get a message saying that there are missing files. More my computer is slow, and I lost a f

  • How to clean Windows

    I started to reformat windows different... From XP/Vista / Windows 7, etc... I did too a clean re-install... [To make my own PC] Now my Question is? What is the best thing to do, to make Windows free & Clean... There are so many software malicious ad