Preventing Attacks On Access Controls Computer Science Essay

Published: Last Edited:

This essay has been submitted by a student. This is not an example of the work written by our professional essay writers.

Access control, is a means by which a web application grants access to specified content and functions to some users and not others. Access control vulnerabilities, which cause privilege escalations, are among the most dangerous vulnerabilities in web applications. Unfortunately, due to the difficulty in designing and implementing perfect access checks, web applications often fall victim to access control attacks [1].

There are a wide range of issues that prevent the application from being secure from access control attacks like Insecure IDs, Forced Browsing Past Access Control Checks, Path Traversal, Client Side Caching, and Limit file permissions on web files. The major part of this paper will discuss about various methods of securing a web application form access control attacks and detecting access control vulnerabilities such as Forced Browsing Past Access Control Checks, Limit file permissions on web files, Path Traversal, etc. This paper will also include a brief introduction to Access control vulnerabilities and their types.

1.1 Keywords: Access Control Attacks, Securing access controls


Access control, sometimes called authorization, is the means by which a web application grants access to specified content and functions to some users and not others. Access control governs what "authorized" users are allowed to do. Access control sounds like a simple problem but is insidiously difficult to implement correctly. A web application’s access control model is closely tied to the content and functions that the site provides. In addition, the users may fall into a number of groups or roles, with different abilities or privileges [5].

Web applications often restrict privileged accesses to authorized users. While bringing the convenience of accessing a large amount of information and operations from anywhere into people’s daily lives, web applications have opened a new door for attacks and the number of web-based attacks is on the rise. A vulnerability is defined in the RFC 2828 [7] as "A flaw or weakness in a system's design, implementation, or operation and management that could be exploited to violate the system's security policy".

Access Control Vulnerability is an error that occurs due to the lack of enforcement pertaining to users or functions that are permitted, or denied, access to an object or a resource. Its impact is, without authenticating or routing a user he can access Files, objects, or processes directly [8].

Access control vulnerabilities in web applications are on the rise. In its 2010 "Top 10 Most Critical Web Applications Security Risks", the OWASP reported that the prevalence of access control vulnerabilities in web applications increased compared to 2007. However, in contrast to SQL injection and cross-site scripting flaws, access control vulnerabilities comparatively received much less attention from the research community [1].

Access control vulnerabilities, which cause privilege escalations, are among the most dangerous vulnerabilities in web applications. Unfortunately, due to the difficulty in designing and implementing perfect access checks, web applications often fall victim to access control attacks. In contrast to traditional injection flaws, access control vulnerabilities are application-specific, rendering it challenging to obtain precise specifications for static and runtime enforcement. On one hand, writing specifications manually is tedious and time-consuming, which leads to non-existent, incomplete or erroneous specifications. On the other hand, automatic probabilistic-based specification inference is imprecise and computationally expensive in general [2].

Designing a secure authentication and access control system in a web application is difficult. Part of the reason is that the underlying file system and database layers perform operations with the privileges of the web application, rather than with privileges of a specific web application user. As a result, the web application must have the superset of privileges of all of its users [3].


There are many types of attacks that can be attributed to compromising access control systems and processes to gain unauthorized access. The following are some of the prominent ones,

Port Scanning and Compromise:

Backdoors are the open ports created by malicious programs that allow an unauthorized entity to gain access into the system.


Denial of Service (DoS) is a type of attack wherein the legitimate users of the system are prevented from access by the reduction of availability. A Distributed Denial of Service (DDoS) is a type of attack where multiple systems attack a single resource from distributed locations. SYN attacks, Teardrop attack, Smurf are some of the examples of a DOS attack.


Hijacking is an attack in which the session established by the client to the server is taken over by a malicious person or process.


The Man-in-the-Middle-attack is a type of attack where an attacker hijacks the established session by the client to the server by substituting his public key for the client's.

TCP hijacking is a type of attack in which the TCP session of the trusted client to the server is hijacked by an attacker.

Malicious Code:

There are many malicious codes. The basic functionality of malicious code is to execute itself in the client machine and compromise the security.

A Trojan horse is a type of malicious code that comes disguised inside a trusted program. Once installed, this malicious code can open ports, create backdoors to the system, and do innumerable security breaches. When the Trojan horse is activated on a particular event (such as a particular date), it is known as a logic bomb.

Malicious mobile codes are executed in the client system through the network from a remote server.

Password Attacks

Password guessing is one of the attacks that use various methods to obtain the users' passwords. Use of a strong password with a combination of alphanumeric and special characters is a helpful countermeasure. Also, adhering to strict password policies such as frequent password changes, length of passwords, history of passwords are effective against such attacks.

Dictionary attacks are a type of password-guessing attack that check the encrypted password database with words found in a dictionary.

Brute force attacks are the means by which the password database is attacked with all types of letters and combinations.

Hybrid attacks combine the dictionary as well as brute force attacks.

Replay attacks are the ones in which the session (like authentication) is captured and replayed against the system.

Vulnerability Compromises:

Scanning is an attack that probes the network and system to identify vulnerabilities for planning a possible attack to compromise.

Vulnerability exploitation is a way of attacking systems by compromising the holes, or errors in the operating system or application software, to gain access or bypass the security controls.

Spoofing is a type of attack to imitate a trusted entity, thereby making the system trust this imitated entity. IP spoofing is an example of such an attack.

Social engineering is a type of attack to obtain credential information such as passwords, PIN numbers, and so on. By using social skills such as impersonation, fake emails, and so on.



Strong session management and encryption is the countermeasure for Hijacking attacks.


A countermeasure for DoS attacks is through the regular monitoring of network activities.

Vulnerability Compromises:

An important countermeasure to vulnerability compromises in systems is to periodically scan and fix the vulnerabilities in the IT systems using vendor-supplied patches as well as other means of filtering and protection by using suitable vulnerability management tools.

Malicious Code:

An important countermeasure for malicious code is to use and update the anti-virus systems, the firewall, and intrusion detection systems.

Port Scanning and Compromise:

An important countermeasure for port scanning and compromise attacks is to periodically check the open ports in the system and close any ports that are not in use by authorized programs. Port scanning tools will help in this process.


5.1 Fast Detection of Access Control Vulnerabilities in PHP Applications: [1]

This paper presents ACMA (Access Control Model Analyzer), a model checking-based tool for the detection of access control vulnerabilities in PHP applications. The core of ACMA uses a lightweight model checker to detect the privileges that are enforced at each statement of an application. Based on this information, ACMA can detect several types of access control vulnerabilities: from forced browsing vulnerabilities to faulty access controls. We show how, when compared to the state of the art, ACMA achieves advantageously comparable results with accelerations up to 890 times faster. Moreover, contrary to the state of the art, ACMA scales up to medium-large applications with large access control models, as shown by the analysis of Moodle, a 400,000+ LOC application counting more than 200 distinct privileges. Results show that ACMA is fast, precise and scalable making it a practical tool for the detection of access control vulnerabilities in real-world applications.

5.2 CLAMP: Practical Prevention of Large-Scale Data Leaks: [6]

This paper is concerned about securing Web server from becoming lucrative targets for attackers. A compromise of any of the Web server's scripts, applications, or operating system can leak the sensitive data of millions of customers. Unfortunately, many systems for stopping data leaks require considerable effort from application developers, hindering their adoption. This paper proposes CLAMP, architecture for preventing data leaks even in the presence of Web server compromises or SQL injection attacks. CLAMP protects sensitive data by enforcing strong access control on user data and by isolating code running on behalf of different users. By focusing on minimizing developer effort, we arrive at an architecture that allows developers to use familiar operating systems, servers, and scripting languages, while making relatively few changes to application code - less than 50 lines in our applications.

5.3 Static detection of access control vulnerabilities in web applications: [2]

This paper describes about the first static analysis that automatically detects access control vulnerabilities in web applications. The core of the analysis is a technique that statically infers and enforces implicit access control assumptions. Our insight is that source code implicitly documents intended accesses of each role and any successful forced browsing to a privileged page is likely vulnerability. Based on this observation, our static analysis constructs sitemaps for different roles in a web application, compares per-role sitemaps to find privileged pages, and checks whether forced browsing is successful for each privileged page. We implemented our analysis and evaluated our tool on several real-world web applications. The evaluation results show that our tool is scalable and detects both known and new access control vulnerabilities with few false positives.


Access controls are the most common areas of vulnerability during the recent period. There is a quite increase in the number of attacks occurring on access controls. Due to the increase in the indent of Users and Websites in the Internet the number of access control flaws, are also increasing day by day. This paper discusses about the design flaws in web applications and different types of possible attacks that occur on web applications. It also discusses on the possible countermeasures for the different types of attacks that occur on access controls.

As research on access controls is very much neglected and good security mechanisms lack till date. This can be quite a good topic of research in the field of web application security.