We often see meaningful data when we work on web development, like credentials as key-value pairs of username and password, secrets, and authorization tokens carrying a unique alphanumeric combination that allows us to access private information or restricted services.

Probably, this might explain why many developers tend to overlook 'loose ends' or information that doesn’t appear dangerous. In other words, developers might unintentionally ignore small details or risks because they don't seem significant at first glance.

Additionally, since cybersecurity decisions are often based on potential impact, anything not immediately seen as impactful might not be considered a potential risk for system exploitation.

The risk of 'loose ends'

For example, what would you think if you see the word 'Daniel' appearing in comments in the codebase? Nothing, right? It might be perceived as non-dangerous information, but I would like you to consider this: What would happen if 'Daniel' is the word corresponding to a username with access through SSH.

Then, maybe 'Daniel' is a 'loose end' in our codebase revealing a valid SSH username, and this piece of information could lead to our system exploitation.

The risk of defaults

The risk with defaults often involves both predictability and disclosure, which allows attackers to quickly plan exploitation strategies. Default settings are often well-known, which can make it easier for attackers to exploit them for unauthorized access or data exposure.

Default configurations can expose predictable endpoints that attackers can exploit to gain insights into the system or find weaknesses, reach resources, or reveal sensitive information that can be used to compromise the system further.

Defaults can expose predictable endpoints or paths that attackers might exploit to gather information about the system, find weaknesses, reach sensitive resources, discover vulnerabilities, or reveal sensitive information that can be used to compromise the system.

For example, consider an attack simulation on a Windows system with SSH enabled. If the system has default configurations, there might be predictable elements that attackers can exploit. For instance, if user credentials are stored in default or known locations, attackers might target paths such as C:\Users\[user]\.ssh\id_rsa, where sensitive files like SSH keys could be found.

Consider the case of 'Daniel', a valid SSH username. If the credentials are stored in the default path as C:\Users\[user]\.ssh\id_rsa, and an attacker knows 'Daniel' is a legitimate user, they could exploit this information. If there's a vulnerability in the web platform, it might allow the attacker to exfiltrate the id_rsa file and potentially gain access to the system through SSH.

Conclusion

Risk management isn’t just about assessing the impact after something happens, it’s also about proactively preventing risks from emerging. This underscores the importance of preventing the exposure of system information, no matter how harmless it may seem.