Information disclosure by identifiers

Question

I'm doing a small research and I observed quite a lot of sites that reveal some private information in the ID-s that they assign. As an example I would like to point out e-commerce sites that issue auto increment ID-s for new customer orders.

By monitoring such information an adversary may obtain important marketing related data about a given site, e.g. how much orders a site makes per day, how much items are ordered, how much items per order were made. Sometimes this is sufficient for a fairly good evaluation of the site income.

To continue I saw few sites that reveal the number of their registered users in the same way. Paired with the number of new orders this creates even more statistical information.

My question is - are these problems really important? If I make a security audit where should I position such reports in the risk matrix?

Answer 1

This flaw should be graded by capability and exploitability.

Capability falls into the following categories:

1. The ability to alter information on the system that you should not be able to.
2. The ability to view information on the system that you should not be able to, such that a person's personal information is revealed, or credentials (or other items of information) are leaked that may aid an attacker in gaining further access to the system.
3. The ability to view incidental information on the system that you should not be able to, e.g. the sum of the prices of items in another user's basket on an e-commerce site.
4. No ability.

Exploitability falls into the following categories:

1. Trivially exploitable in a reliable manner, e.g. admin's user is always ID 1, or users are always given sequential IDs.
2. Moderately difficult to exploit, e.g. having to search through a sequence of 24-bit integers for potential identifiers.
3. Difficult to exploit, e.g. computing G_n+1 from G_0..n, where G is a poor quality random number generator.
4. Impossible* to exploit, e.g. the problem equates to brute forcing a 128-bit keyspace. (* impossible = highly improbable, and way outside the cost/benefit ratio for attackers)

Note that this is not an integer scale - feel free to rate something as, for example, a 2.5 in capability.

The trick is that without exploitability, capability is pointless, and without capability, exploitability is meaningless.

In order to grade this, consider the above points, and compare your ratings to the importance of the protected resource. Also remember that sequential IDs make development easy, so the risk analysis should take this into account.

As a rule of thumb, if you're looking at anything worth protecting, and the mean average of the two numbers is less than 2, call it a high. If it's greater than two, it's entirely subjective.

I also suggest you take a look at the Common Vulnerability Scoring System (CVSS) and NVD's CVSSv2 calculator, which does a great job of demonstrating vulnerability assessment and scoring.

Answer 2

I would suspect that most companies would consider that the organizational benefit of having sequential order numbers outweighs the drawbacks to somebody being able to glean how many orders there may be in a certain period of time. Plus, customers like to keep their orders organized by order number, so there'd likely be some unhappy customers if you randomized this information.

Even if an organization did use randomized order or customer IDs if an attacker was able to see them as they are created he/she would be able to count them anyway, so there's little benefit to randomization.