What is the difference/relationship between data leakage analysis and vulnerability analysis? How much and what kind of vulnerability testing is required for data leakage analysis?

I have to give data leakage analysis report for some mobile applications. According to what I know, data leakage is happening when an app itself is sending important data to outside environment e.g. to remote server or a log file(which is accessible to other apps on mobile OS) or keeping it in some unsafe and vulnerable place.

According to my understanding, I only have to check how is app communicating and saving important data.

As for vulnerabilities and exploitation, so it is possible that some malicious party can use sophisticated and clever ways to hack an app, and steal its data. I.e. they neither hacked the victim's data communication method nor the possible storage locations(e.g. log), but some other component of application. E.g. call a function with a different remote server to send data to....

I understand that some vulnerability analysis will be required, e.g. data posted to server should not be un-encrypted....but how much deep(and what kind of) vulnerability analysis is required usually? E.g. the scenario that I mentioned in above paragraph, are such testing required?

  • 2
    This answer should come from the client/team you are delivering the report to. Ultimately, the definition of the terms doesn’t matter because the client/team can have different expectations. What matters is you’re analyzing what the client/team expects you to. – Paraplastic2 Mar 2 '15 at 13:59

"Data Leakage" is typically defined as unauthorized data that becomes available due to the actions of the normal operation of the program/user. As for your example of data transmitted unencrypted, I would see that as not a a vulnerability analysis but a normal part of a data analysis (any place the data touches requires appropriate protections for the classification of that data).

The relationship, then, to "vulnerabilities" has to do with information that can be extracted if a user exploits a weakness in the program.

The difference is normal operation vs unexpected operation.

As for how much Vulnerability Analysis might be required, it depends on the scope and expectation of the report. If you are tasked with defining the impact of normal operations ("operational focus"), then you do not need to do any vulnerability testing. If, on the other hand, the report is supposed to define each and every threat the to data ("data focus)", then you need to perform very detailed analysis of not only the potential vulnerabilities, but also a deep dive into an analysis of the code and architecture itself.

| improve this answer | |

Vulnerabilities can range from "go home, you're pwned" to "pest". Of course, if you completely take over a system, all its data is there for you to harvest. Data leakage can be intrinsic to the design of an application (transmitting data on the wire in plaintext), a mistake in programming (hey, that session ID is off by one!), or it can stem from vulnerabilities like SQLi, XSS or CSRF.

When you're looking for data leakages, check for good access/transport controls and make sure those controls cannot be circumvented by a vulnerability. Watch out for the garden variety vulnerabilities too, because you can leverage them to get your target system to give you protected data.

Data leakage is your goal. You can get there in a variety of ways, which you need to enumerate to the best of your ability.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.