Metadata – Threats, PII at RISK ?

Metadata – Threats, PII at RISK ? Sudesh Gadewar

Agenda • Meta-Data • Who, What, When, Where, How, Why • Various types of Metadata • Metadata association - PII Risks • Security issues - Metadata WSDL/content spoofing • Security Considerations in Metadata

Metadata • Metadata, data about data. Metadata gives information about the other Data. • Metadata is information about resources: • individual files • collections of files (relationships among files) • complete projects (relationships among files and collections)

Meta-Data formatting • Who – Created the Data • What – is the content of the Data ? • When – is created • Where – is it geographically • How – is the data Developed • Why – is the Data Developed

Meta-Data association • Metadata associated with emails: • Sender's name, email, and IP address • Recipient's name and email address • Date, time, and time zone • Unique identifier of email and related emails • Mail client login records with IP address • Mail client header formats • Subject of email

Meta-Data association • Metadata associated with mobile phones: • Metadata associated with mobile phones: • Phone number of every caller • Serial numbers of phones involved • Time of call • Duration of call • Location of each participant • Telephone calling card numbers

Meta-Data association • Metadata associated with web browsers: • Activity including pages the user visits and when visited • User data and possibly user login details with auto-fill features • User IP address, internet service provider, device hardware details, operating system, and browser version • Cookies and cached data from websites

Various types of Metadata • Descriptive: • Facilitates discovery and describes intellectual content • Administrative: • Facilitates management of digital and analog resources • Technical: • Describes the technical aspects of the digital object • Structural: • Describes the relationships within a digital object • Preservation: • Supports long-term retention of the digital object and may overlap with technical, administrative, and structural metadata

Metadata WSDL/content spoofing MetaData Sample : • <meta name="description" content="Testing the page for MetaData security and Vulnerability " /> • <meta name="keywords" content="Finding out the threats in MetaData" /> • <meta name="author" content="metatags generator"> • <meta name="robots" content="index, follow"> • <meta name="revisit-after" content="3 month"> • <title>Testing the page </title>

<wsa10:EndpointReference xmlns:wsa10="http://www.w3.org/2005/08/addressing"> <wsa10:Address>http://services.example.org/stockquote</wsa10:Address> <wsa10:Metadata> <mex:Metadataxmlns:mex="http://schemas.xmlsoap.org/ws/2004/09/mex"> <mex:MetadataSection Dialect="http://schemas.xmlsoap.org/ws/2004/09/mex"> <mex:MetadataReference> <wsa10:Address> http://services.example.org/stockquote/metadata </wsa10:Address> <wsa10:Metadata> <mex:Metadata> <mex:MetadataSection Dialect="http://schemas.xmlsoap.org/wsdl/">  <wsdl:definitions targetNamespace="http://schemas.xmlsoap.org/ws/2004/09/transfer" xmlns:tns="http://schemas.xmlsoap.org/ws/2004/09/transfer" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsdl="http://schemas.xmlsoap.org/wsdl/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xs="http://www.w3.org/2001/XMLSchema"> <wsdl:types> <xs:schema> <xs:import namespace="http://schemas.xmlsoap.org/ws/2004/09/transfer" schemaLocation="http://schemas.xmlsoap.org/ws/2004/09/transfer/transfer.xsd" /> </xs:schema> </wsdl:types> <wsdl:message name="EmptyMessage"/> <wsdl:message name="AnyXmlMessage"> <wsdl:part name="Body" type="tns:AnyXmlType"/> </wsdl:message>

<wsdl:portTypename="Metadata_Resource_Port"> <wsdl:operation name="Get"> <wsdl:input message="tns:EmptyMessage" wsa:Action="http://schemas.xmlsoap.org/ws/2004/09/transfer/Get" /> <wsdl:output message="tns:AnyXmlMessage" wsa:Action="http://schemas.xmlsoap.org/ws/2004/09/transfer/GetResponse" /> </wsdl:operation> </wsdl:portType> <wsdl:bindingname="Metadata_Resource_Port_Binding" type="tns:Metadata_Resource_Port"> <soap:binding transport="http://schemas.xmlsoap.org/soap/http"/> <wsdl:operation name="Get"> <soap:operationsoapAction="http://schemas.xmlsoap.org/ws/2004/09/transfer/Get" style="rpc"/> <wsdl:input> <soap:body use="literal"/> </wsdl:input> <wsdl:output> <soap:body use="literal"/> </wsdl:output> </wsdl:operation> </wsdl:binding> <wsdl:servicename="Metadata_Resource_Service"> <wsdl:portname="Metadata_Service_Port" binding="tns:Metadata_Resource_Port_Binding"> <soap:addresslocation="http://example.org/soap12/example1/metadata"/> </wsdl:port> </wsdl:service> </wsdl:definitions> </mex:MetadataSection> </mex:Metadata> </wsa10:Metadata> </mex:MetadataReference> </mex:MetadataSection> </mex:Metadata> </wsa10:Metadata> </wsa10:EndpointReference>

Content Spoofing • Demo on WSDL spoofing • Demo on on Content Spoofing

Security Considerations in Metadata • End user access should be read-only • Treat meta data components as any other database component: • Create users and groups • Grant access to groups • Use row-level security (or equivalent) if needed • Publish/disable MetaData • Use Secure bindings • Trusted MetaData • Safe Techniques

Thank you

Metadata – Threats, PII at RISK ?