Question

1. Delegation
   1. Describe what the confused deputy problem is

Answer 1

Solution :-

• In the field of information technology, the confused deputy problem is a specific type of privilege escalation.
• It is cited as an example of why capability-based security is important.
• The confused deputy is a more privileged computer program or legitimate whose authority is misused by tricking it by some other program.

Real life examples of Confused Deputy Problem -

1) FTP Bounce Attack -

• It is one of the example of Confused Deputy Attack.
• Here the PORT command is used by the attacker and victim machine's FTP server is used in order to get access to TCP ports.
• Here the attacker has the permission to connect.
• In this case the FTP Server is the confused deputy.

2) Cross-site request forgery(CSRF) -

• In this attack the user who is authenticated to web application is tricked to perform unwanted malicious actions like funds transfer or changing of password.
• Cookies are used by web applications to authenticate all request transmitted by a browser.
• The attacker takes the advantage of these cookies and use Javascript for submitting an authenticated HTTP request using client's authority of the browser.

3) Clickjacking -

• This attack is also called as UI Redress Attack. In this attack the user is tricked by knowingly or unknowingly clicking on malicious link or button.
• The attacker uses opaque or transparent layers in webpages for this attack to happen.
• In this attack, an attacker controlled website is visited by the user thinking that he/she is harmlessly browsing the website.
• The user's click is hijacked and routed to a different malicious page.
• But the user is tricked to behave as a confused deputy and performs sensitive actions falling prey to malware.

How to prevent from Confused Deputy Attack?

• Proper precautions should be taken in order to prevent from this attack.
• Explicit attention is required to security by the server. This extra step might not been taken by a naive or careless server.
• Bundling the designation of an object and permission to access that object together. This is called as capability.