A systematic review of security threats and countermeasures in SaaS

The threat agents can carry out an attack. This kind of threat can originate from a user or software.

An application or an attacker that makes attacks on the network from the Internet.

An application of malicious logic.

An attacker being a cloud client who has shared resources of an infrastructure.

Malicious experts are human threats that act on behalf of cloud providers.

ARP Spoofing. This attack is when a malicious person sends an altered ARP message to redirect to a malicious host. Because ARP does not require checking the source, the attacker can plan an ARP attack by deriving connections to a specific host. As security measures, detection, encryption, filtering in ARP tables should be used [1,16].

Backdoor and debug options. This type of attack occurs when developers leave debugging enabled in their applications. With this, the attacker can easily make changes to the application [9,41]. To counteract this attack, the debug option, periodic scans, and directory review must be disabled [9,41].

Broken authentication. This happens because of the incorrect implementation of authentication management. Some threats are user credentials which can be discovered due to weak account management functions, unencrypted credentials, session data being presented in the URL, etc. This can enable a malicious person to steal the identity of a legitimate user; usually an attacker searches for an account with limited permissions [24]. The main attacks of this type are brute force attacks, phishing attacks, account hijacking attacks, internal attacks, and keylogger attacks [17]. To counteract these attacks, there are prevention methods such as strong authentication implementation, shielding against Cross Site Scripting by avoiding script failures, access control, use of indirect references of objects either by user or by session, automatic verification implementation, mechanisms for Multilevel authentication, and the use of digital fingerprint signatures (this may involve high costs) [17].

Buffer overflow. This happens when an application tries to store more data in a buffer than it supports. Buffers must contain a static amount of data. When an overflow of the buffer occurs, the content is corrupted or overwritten [18]. Because of this, an attacker can execute malicious code and obtain administrator privileges [47]. A countermeasure for this attack is the randomization of instructions [16].

Code Injection. The nature of the cloud is to handle shared environments. Thus, attackers are able to insert malicious code into applications to obtain sensitive data from users. If the user clicks on an infected URL, this can execute code on the use’s machine, which can cause the attacker to access the user’s information. SQL injection is one of the most common techniques of this type of attack. It allows an attacker to insert SQL commands from web formulas to access a database. Active content filtering is used to detect this type of attack and provide the use with dynamically generated SQL in the code [9,17,18,47].

Cookie Poisoning. This attack occurs when an attacker manages to obtain a victim’s cookies in order to gain access to an application. Because cookies contain information for logging into applications or websites, the attacker can falsify them to be authenticated as an authorized user. As a precautionary measure, cookies stored on the user’s computer must be periodically deleted [9,41].

Cross-Site Request Forgery (CSRF). This type of attack is when a user’s browser is made to send a false HTTP request with sensitive data, such as cookies and authentication credentials. While the legitimate user is connected to an application and visits a malicious site, this site can inject code into the client’s browser, which can lead to identity or data theft, such as credit card data [7,47]. As prevention measures, the use of secret tokens and reference and origin headings [16] is recommended.

DNS Poisoning. DNS servers relate IP addresses to a domain name. If this relation becomes corrupted, the attacker can redirect a user to a malicious website. To prevent this attack, the application of encryption and filtering is recommended [1,9,16].

Dumpster Diving. This technique consists in the attempt to recover information from data that was insecurely deleted. The malicious user manages to restore the data that the user deleted. In this way an attacker can focus on a specific user to obtain relevant information. Deleted data may contain credentials, cookies, and credit card numbers, among other things. To reduce the possibility of suffering this attack, the implementation of a security policy for the elimination of both physical and digital documents is recommended [26,32].

Eavesdropping. This attack happens when an attacker listens to network transmissions without being detected, causing a confidentiality failure. Transmissions can be messages, calls, and videoconferences, among other transmissions [13,22]. A security method is the implementation of IPsec [9].

EDoS. This attack is focused on customer billing. It consists of inflating the costs of the services granted to users. DoS attacks on payment-for-use services will result in an increase in the use of bandwidth, CPU, and storage [9]. As a security measure, a firewall must be implemented for the detection of EDoS [27]. In addition, graphical tests of EDoS Shield and Alosaimi Turing can be performed to avoid such attacks [40].

Google Hacking. An attacker can use search engines, such as Google, because this is a good option for obtaining confidential data from a user or organization. With this method they can discover security breaches in applications and carry out other attacks [9,41]. The security measures proposed are to avoid sharing sensitive information on websites and to use tools for vulnerability scanning [9].

Hash Value Manipulation. This type of attack occurs when a malicious person alters the hash value of a message in order to gain access to a file. If the altered hash value is hosted in the database, the server links the file with the hash value. On the other hand, if the altered hash value is not found in the database, the server requests a file from the user. This vulnerability can occur in cases where the server uses OpenSSL with the Ncrypto class. As a security measure, the implementation of strong communication protocols using encryption and probabilistic tests is required [26,29].

Hidden field manipulation. This attack occurs when the application developer uses hidden fields for the user. For example, it can be used to save prices, but an attacker can take advantage of this to make purchases with altered prices. So it is necessary to avoid placing hidden fields to mitigate this type of attack [9].

Malware injection and steganography attacks. This attack happens when it is possible to inject malicious code into an application. In this way, an attacker can insert code into the files that pass through the network. Because it seems that a normal file is being sent, security tools can ignore this attack [21]. In [21], the use of schemes such as StegAD for the detection of such attacks is proposed.

Man-in-the-middle Attack. This happens when a malicious person intercepts a communication between two users. The hacker can just listen to the message and forward or modify it. In this way, the attacker obtains sensitive data from the users. This attack can occur due to an Internet protocol failure, weak password management, the use of insecure wireless networks, and weak authentication. As security measures we recommend the implementation of secure channels through SSL and applying authentication and authentication measures to the nodes. Some useful tools to prevent these attacks are Airjack, Cain, Dsniff, and Ettercap [1,9,13,17,38].

Meta Data Spoofing Attack. This occurs when an attacker alters the information about the services hosted in Web Services Description Language when delivered. In this way, the attacker gains access to sensitive applications and data. As a security measure, the functionality of the service must be encrypted and robust authentication mechanisms required to access this service [1,38].

Phishing Attack. Phishing is a technique that consists in redirecting a legitimate user to a fake website [2]. As a result, users believe that it is a reliable website, and so enter their credentials, thus compromising the user account [2,38]. To improve cloud security, encryption must be implemented, as well as the use of TLS for applications. Finally, the use of certificates through HTTPS is essential [17,38].

Port scanning. An attacker uses port scanning to find out if they are open, closed, or filtered. A malicious person uses the open ports to obtain information from the network. If a port is configured to accept traffic without any filters, this port will be affected by a port scan. As a security measure, the ports must be filtered and when a scan is detected, the scan must be blocked [9,38].

Race Condition. This attack happens when several processes access the same data simultaneously. A malicious person can have administrator permissions while an application is in administrator mode [47]. The work presented in [19] proposes a technique called predicate update to detect this attack.

Replay attack. This type of attack occurs when an attacker reproduces a message obtained by the recipients [13] in order to gain access to unauthorized data [9]. For its detection without affecting the performance of the system, in [48] the implementation of a stochastic coding scheme is proposed

Reused IP address. If a user changes networks and another one is assigned the same IP address, this leads to a security problem. This is because the user assumes that their resources are not accessible when leaving the network, but if a new user obtains the first user’s IP address, the new user can have access to these resources, something which violates the privacy of the first user. To avoid this security problem, the elimination of cache in ARP tables is proposed [9].

Service Injection Attack. This happens when an attacker manages to inject a malicious service which causes users’ requests to be automatically redirected to malicious services. As a result, the integrity of the data is lost, and the theft of accounts or services is enabled. As a security measure, we propose the use of a robust asylum mechanism, mechanisms for identifying virtual machines, and using integration services [1].

Shared architectures. Because SaaS runs in a shared architecture, it is possible to detect the application execution path. In this way, the attacker can get enough information for the theft of user accounts. As a countermeasure, the application’s binary code should be reviewed [21].

Sniffing. Sniffing is a technique that uses a software tool to capture packets that are travelling through the network [2]. An attacker could steal sensitive data, such as credentials and credit card data [10]. As a precautionary measure, the use of cryptographic protocols such as SSL and TLS, the implementation of IPsec, and the encryption of each IP packet is recommended [10].

Social Engineering. These attacks occur when a malicious person has legitimate users reveal their sensitive data, such as credentials, emails, and credit card numbers, among other things, through deception. This is achieved through the use of web pages, telephone contact, and fake emails, among other techniques [17,47]. The main approaches to reduce this type of attacks are to implement security policies and user training [23].

Sybil attack. The attacker steals the identity of a user to create a relationship with a legitimate user which can lead to the attacker raising their privileges within the system [9]. As a solution, the implementation of a symmetric encryption algorithm is recommended [44].

User to Root Attack. This is when an attacker obtains the privileges of an administrator user. This is achieved by overflowing data in an application. To reduce the risk of this attack, which can have serious implications for confidentiality and integrity, we recommend using strong passwords and a better authentication mechanism [38]. Also, it is necessary to adopt a privilege separation mechanism to manage privilege access control between different platforms [47].

XML signature wrapping attack. This attack happens when there is a vulnerability in SOAP messages. When the user sends a request through the browser, the server generates a SOAP message. This message can find the information used to establish communication between the client and the server. If the attacker manages to compromise the message, the attacker can be authenticated as a legitimate user. As a preventative measure for this attack, the use of tools for vulnerability scanning and manual verification is recommended [17].

Zombie Attack. Also known as a distributed DoS attack, this type of attack is harder to detect than a DoS attack. The attacker has several infected machines, called zombies, execute attacks remotely [38]. As security measures, the implementation of IDS / IPS systems, load controls, ICMP and SYN packet limitation, IP address filtering, detailed detection analysis for intruder detection, and better authentication and authorization controls are recommended [1,9,10,17].