ICACT20220047 Question.1
Questioner: vasaka.vis@mahidol.ac.th 2022-02-11 오후 6:34:20 |
ICACT20220047 Answer.1
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-11 오후 6:34:20
Chrome  Click!! |
| Don't you have a Youtube video for your presentation? |
Thanks for your question.
Youtube video is now available.
link is here(https://www.youtube.com/watch?v=48aDj3oLYkk)
Sorry for your inconvinience. |
ICACT20220047 Question.2
Questioner: tomayoon@ieee.org 2022-02-14 오후 3:33:14 |
ICACT20220047 Answer.2
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-14 오후 3:33:14
Chrome Click!! |
| First of all, thank you for the good research paper and presentation contents. I would like to know more about the research environment used in this study, and also in detail about the equipment & operating systems, development languages and software libraries you used. |
Thanks for your question.
First, we have built a CentOS 7 virtual environment using VirtualBox.
We used Apache version 2.4.37 for the web server and built WordPress version 4.7.0.
We built MaridDB version 10.3 as the database to work with WordPress.
Second, we use Python for the implementation of our proposed method.
We used the Requests library for sending requests.
We also used other libraries such as the OS library for file input and output, and the RE library for data extraction using regular expressions. |
ICACT20220047 Question.3
Questioner: tomayoon@ieee.org 2022-02-15 오후 12:33:33 |
ICACT20220047 Answer.3
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-15 오후 12:33:33
Chrome Click!! |
| Will you tell us what is the major achievement of this paper, and also what is further study issue from this? Thanks in advance!! |
Thanks for your question.
The achievement of our research is that we have proposed a method that can detect WordPress vulnerability, which is difficult to detect by existing vulnerability assessment tools.
As future work, we are planning to consider the load on the web server and the detection method for other OWASP API TOP 10 vulnerabilities. |
ICACT20220047 Question.4
Questioner: vasaka.vis@mahidol.ac.th 2022-02-15 오후 2:58:48 |
ICACT20220047 Answer.4
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-15 오후 2:58:48
Chrome Click!! |
| Thank you for your presentation :)
The research topic is very interesting. I have a few questions.
(1) Why you target only OWASP API no.1 and no.5?
(2) What programming languages you used to develop your proposed vulnerability assessment tool? Or you just use the existing opensource tool?
(3) On slide no. 16, your proposed method could not detect the vulnerability No.1. Is there any reason behind? Or the version of your WordPress just does not contain this vulnerability?
|
Thanks for your question.
(1) We targeted OWASP API' s No.1 and No.5 because these vulnerabilities are related to access control and are the most threatening to WebAPI.
(2) We used Python to implement the proposed method.
(3) We believe that this is because the vulnerability did not exist in the 4.7.0 version of WordPress. However, there is a possibility that an unknown vulnerability existed but we could not detect it, so we are considering improving the detection method of the proposed method. |
ICACT20220047 Question.5
Questioner: nyamai@cc.tuat.ac.jp 2022-02-15 오후 5:23:10 |
ICACT20220047 Answer.5
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-15 오후 5:23:10
Chrome Click!! |
| Thank you for your good presentation. I have some questions. What percentage of the total vulnerabilities are vulnerabilities No.1 and No.5? In particular, since vulnerability No.1 was not found in Word press 4.7.0, could you show us an actual example of software with vulnerability No.1? |
Thanks for your questions.
First, about the percentage of No.1 and No.5, we don't know how many of these vulnerabilities are included in the actual WebAPI.
The reason for this is that the details are not described in the OWASP API TOP 10.
Second, I will explain the No.1 example.
The vulnerability that corresponds to No.1 is reported to be in Ghost CMS WebAPI.
The Ghost vulnerability is a vulnerability that allows general users to access information that requires administrative authorization by using a specific endpoint that is not published in the reference.
For more information on the Ghost vulnerability, please refer to the following link.
https://medium.com/@zn9988/cve-2021-3271-ghost-cms-4-0-0-d174162482a4 |
ICACT20220047 Question.6
Questioner: nyamai@cc.tuat.ac.jp 2022-02-15 오후 9:20:27 |
ICACT20220047 Answer.6
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-15 오후 9:20:27
Chrome Click!! |
| Thank you for your reply. Now, let me ask one more question. Is it possible to evaluate the effectiveness of your proposal on Ghost CMS having No.1 vulnerability? I think a vulnerable Ghost CMS could be obtained by the following URL. https://github.com/TryGhost/Ghost/releases?page=7 |
Thanks for your questions.
Our proposed method can detect the vulnerability of Ghost CMS.
In fact, we have conducted an evaluation experiment using Ghost CMS and succeeded in detecting the vulnerability.
Please refer to the following document which describes the results of our proposed method for detecting Ghost vulnerability.
Toru Taya, Masaki Hanada, Yoichi Murakamii, Atsushi Waseda, Yuki Ishida, Takao Mimura, Moo Wan KIM, Eiji Nunohiro, ``WebAPI Vulnerability Assessment Tool Based on Request and Response Sequences'', The 27th International Symposium on Artificial Life and Robotics (AROB 2022).
As you know the vulnerable version of Ghost CMS can be downloaded from that URL. |
ICACT20220047 Question.7
Questioner: namacabale@gmail.com 2022-02-16 오후 2:10:10 |
ICACT20220047 Answer.7
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-16 오후 2:10:10
Chrome Click!! |
| Dear Author, you have a very good research. Is there an existing technology almost similar to your proposal that has been deployed in real world environment? What does it lack that your work specifically addressed? Thank you and stay safe.
|
Thanks for your question.
There are some WebAPI vulnerability assessment tools available in the web, and our proposed method is influenced by them.
For example, there are "Vooki, Rest API Scanner", and "Automatic API Attack Tool" and so on.
However, these tools use random strings in the request query to conduct vulnerability assessment, and may not be able to detect vulnerabilities.
Therefore, in this research, we are trying to solve this problem by sending a vulnerability assessment request query that uses information from the request and its response. |
ICACT20220047 Question.8
Questioner: yiweimaa@gmail.com 2022-02-16 오후 4:27:49 |
ICACT20220047 Answer.8
Answer by Auhor g20004tt@edu.tuis.ac.jp 2022-02-16 오후 4:27:49
Chrome Click!! |
| Dear Author, you have a very good research. Do you compare your solution with others (commercial or opensource solutions) ? |
Thanks for your question.
Yes, we tried to detect WordPress vulnerability using "Automatic API Attack Tool", which is an open source vulnerability assessment tool, as we did in the evaluation experiment using the proposed method.
As a result, the " Automatic API Attack Tool" could not detect the WordPress vulnerability.
We think the reason is the method of generating the request query of "Automatic API Attack Tool". |
