CWE一覧に戻る
CWE-656

無名による安全への依存

Reliance on Security Through Obscurity
脆弱性 レビュー中
JA

この製品は、そのアルゴリズムや鍵データを知っていれば、そのメカニズムを破るのに十分であるような、強度がその不明瞭さに大きく依存する保護メカニズムを使用している。

このような「不明瞭さによるセキュリティ」への依存は、攻撃者がメカニズ ムの内部構造をリバース・エンジニアリングすることができた場合、結果として弱点 を生み出す可能性がある。曖昧さは、攻撃者により多くの仕事を与えることができるため、深層防衛のほんの一部となりうる。

EN

The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.

This reliance on "security through obscurity" can produce resultant weaknesses if an attacker is able to reverse engineer the inner workings of the mechanism. Note that obscurity can be one small part of defense in depth, since it can create more work for an attacker; however, it is a significant risk if used as the primary means of protection.

Scope: Confidentiality, Integrity, Availability, Other / Impact: Other
Always consider whether knowledge of your code or design is sufficient to break it. Reverse engineering is a highly successful discipline, and financially feasible for motivated adversaries. Black-box techniques are established for binary analysis of executables that use obfuscation, runtime analysis of proprietary protocols, inferring file formats, and others.
When available, use publicly-vetted algorithms and procedures, as these are more likely to undergo more extensive security analysis and testing. This is especially the case with encryption and authentication.
MITRE公式ページ — CWE-656