I wish to write a security review for a specific windows server/client application that runs on a closed LAN or WAN (between 1 and 200+ users across multiple sites); it's not a web-application. The application is widely used (market-leader) within a sector in my country and the information stored within the application is very sensitive.
The types of issues I've already identified are:
- Using a default database username and password (full admin access). This login is kept in plain text within the application folder.
- Storing user passwords in plain text within the database
- No complex password requirements
- Users having access to tools within the application that can run SQL queries (with full privileges; despite their own application level privileges limitations)
- A HTTP server service running on all client machines that responds to API requests. No user/password required.
- Default file share with all application files including the file containing the database/username/password
- Auditing information of user actions (that can be easily altered/deleted/masqueraded - see any of the above!) that have been used as evidence within million-dollar fraud/legal/HR cases
I haven't even looked at things like buffer overflows, SQL injection etc; but a colleague has offered to help me with this.
As I'm a bit new to this; I'm thinking that this would be a technical review (similar a published journal article) un-requested by the vendor? Larger users of this software often secure it as best as they can; I suppose I could write a "hardening" guide instead?
Can anyone provide me advice:
- Any general advice based on the above?
- Should I write a security review or hardening guide?
- Are there some good examples of similar types of reviews? (I can find so many web-application reviews; but not so many application ones - however a couple of the SCADA ones were useful