Error message exploitation
Error message exploitation is a cyber-attack where attackers manipulate system or application error messages to extract sensitive information or identify vulnerabilities for unauthorized access. It involves intentionally triggering errors to gather intelligence about a system's configuration and weaknesses.
Example
Microsoft disclosed a cyberattack by Chinese hackers on US government emails, attributing it to a compromised engineer's account and a key leaked in a crash dump. The company admitted flaws in its systems, including a race condition issue and failure to detect sensitive information leaks. The compromised key led to unauthorized access and email theft from approximately 25 organizations.
Links
- How a Chinese Espionage Group Exploited Microsoft's Mistakes
- Improper Error Handling | OWASP Foundation
- How to Exploit “improper error handling” in Web Applications
