36 lines
1.6 KiB
Plaintext
36 lines
1.6 KiB
Plaintext
|
=== What is the potential impact?
|
||
|
|
After retrieving encrypted data and performing cryptographic attacks on it on a
|
||
|
|
given timeframe, attackers can recover the plaintext that encryption was
|
||
|
|
supposed to protect.
|
||
|
|
|
||
|
|
Depending on the recovered data, the impact may vary.
|
||
|
|
|
||
|
|
Below are some real-world scenarios that illustrate the potential impact of an
|
||
|
|
attacker exploiting the vulnerability.
|
||
|
|
|
||
|
|
==== Additional attack surface
|
||
|
|
By modifying the plaintext of the encrypted message, an attacker may be able to
|
||
|
|
trigger additional vulnerabilities in the code. An attacker can further exploit
|
||
|
|
a system to obtain more information. +
|
||
|
|
Encrypted values are often considered trustworthy because it would not be
|
||
|
|
possible for a third party to modify them under normal circumstances.
|
||
|
|
|
||
|
|
==== Breach of confidentiality and privacy
|
||
|
|
When encrypted data contains personal or sensitive information, its retrieval
|
||
|
|
by an attacker can lead to privacy violations, identity theft, financial loss,
|
||
|
|
reputational damage, or unauthorized access to confidential systems.
|
||
|
|
|
||
|
|
In this scenario, the company, its employees, users, and partners could be
|
||
|
|
seriously affected.
|
||
|
|
|
||
|
|
The impact is twofold, as data breaches and exposure of encrypted data can
|
||
|
|
undermine trust in the organization, as customers, clients and stakeholders may
|
||
|
|
lose confidence in the organization's ability to protect their sensitive data.
|
||
|
|
|
||
|
|
==== Legal and compliance issues
|
||
|
|
In many industries and locations, there are legal and compliance requirements
|
||
|
|
to protect sensitive data. If encrypted data is compromised and the plaintext
|
||
|
|
can be recovered, companies face legal consequences, penalties, or violations
|
||
|
|
of privacy laws.
|
||
|
|
|