Куда я попал?
Payment Card Industry 3-D Secure (PCI 3DS)
Стандарт
Security Checks 1.4
Для проведения оценки соответствия по документу войдите в систему.
Список требований
-
Security Objective 1: Protect the Integrity of the 3DS SDKTo protect the sensitive information handled by the 3DS SDK and to facilitate secure and trustworthy 3DS SDK transactions, the 3DS SDK must implement measures to defend itself in what must be assumed to be a hostile environment (such as in a mobile application operating on a consumer mobile device). Some of the key risks associated with mobile applications and components include threats associated with a “rooted” or “jailbroken” device and threats from other applications operating within the same environment (and with access to shared resources). Appropriate detective and protective mechanisms must be implemented to ensure that the integrity of the 3DS SDK and sensitive 3DS SDK data elements is maintained. Refer to Table 2, “Sensitive 3DS SDK Data Elements,” in the “Scope of Security Requirements” section of this document for more information on which specific 3DS SDK data elements require protection from unauthorized modification.
-
Requirements:1.4 Protection against Reverse EngineeringThe 3DS SDK binaries are protected from reverse engineering.Assessment Procedures:T.1.4.1 The tester shall examine vendor materials and other evidence to confirm that features are provided by the 3DS SDK to protect the 3DS SDK and any data structures that may be stored in memory, the operating system file system, or other storage locations (such as an OS key store) from reverse engineering.Note: This requirement is focused on the determination of the data flow and functions of the 3DS SDK, not necessarily the secrecy of the data.T.1.4.2 The tester shall determine where the SDK or data structures are not covered by these protections, and confirm this lack of protection does not affect the security of the SDK or 3DS operation.T.1.4.3 The tester shall determine all locations where functions provided by the 3DS SDK are executed. This will include the main processing environment of the device, but may also include other local execution environments (such as a Trusted Execution Environment or embedded security processor).T.1.4.4 Where cryptography is implemented for the purposes of obfuscation and anti-tamper, the tester shall determine the locations and data protected by those methods. The tester shall also determine what protection is provided by the cryptography (confidentiality, integrity, or both) and what algorithms and modes of operation are used. The tester shall confirm that cryptography meets PCI requirements for strong cryptography, including applicable cryptography requirements in this standard, and that all keys used for these cryptographic operations are protected.T.1.4.5 Where protections are provided (partially or wholly) through code obfuscation, the tester shall perform the following:T.1.4.5.1 Examine vendor materials and other evidence, including application installation files where the protection methods have been applied, and compare these files to files where protections have not yet been applied to confirm the validity of the vendor attestations and documentation regarding the protection methods implemented.Note: This test may require the 3DS SDK Vendor to provide both obfuscated and un-obfuscated binaries or source code to the 3DS SDK Lab to validate this requirement.T.1.4.5.2 Determine the comparative file sizes between unprotected and protected application samples, as well as the relative compression ratio of each file type when general purpose compression functions are applied to confirm that such analysis does not disclose any sensitive information about the 3DS SDK.T.1.4.5.3 Examine vendor materials and other evidence, and test the software by attempting to reverse engineer the code or extract details of the code execution (e.g., through extraction of ASCII strings, functional linking/interface tables such as PLT/GOT, etc.) to confirm such attempts do not result in the disclosure of any sensitive information about the 3DS SDK.T.1.4.5.4 Analyze any areas of non-traditional execution where the obfuscation relies on virtualized/interpreted commands, non-deterministic operations, or other such techniques to confirm that the exploitation of such techniques does not result in the disclosure of any sensitive information about the 3DS SDK.T.1.4.6 Where protections are provided by the operating environment, the tester shall perform the following: T.1.4.6.1 Examine vendor materials and other evidence, including source code to confirm that such protections provide the required tamper-resistance features and that any elements of code or data that are not covered by these protections cannot be used to reverse engineer the code or disclose sensitive information about the 3DS SDK.
T.1.4.6.1 Examine vendor materials and other evidence, including source code to confirm that such protections provide the required tamper-resistance features and that any elements of code or data that are not covered by these protections cannot be used to reverse engineer the code or disclose sensitive information about the 3DS SDK.T.1.4.6.2 Test the 3DS SDK to confirm that the 3DS SDK will only execute on platforms which provide such integrated protections.T.1.4.7 Where protections are provided by runtime methods or anti-debugging features, the tester shall perform the following:T.1.4.7.1 Examine vendor materials and other evidence to confirm that such protections provide the required tamper resistance features and that any elements of code or data that are not covered by these protections cannot be used to reverse engineer the code or disclose sensitive information about the 3DS SDK.T.1.4.7.2 Confirm that the local software that provides these features is itself protected.T.1.4.7.3 Where any features require interaction with an external system (such as a cloud-based monitoring system), the tester shall confirm that mechanisms are in place to prevent disabling of the remote protections, such as through traffic or communications manipulation.T.1.4.8 Where additional protections are provided by the application, the tester shall confirm that these protections apply across all supported platforms and operating systems (as assessed under Requirement 1.1, “Security Checks”), or that any gaps that exist in coverage of these protections do notincrease the risk posed by those platforms.T.1.4.9 Where device-specific features are relied upon, the tester shall attempt to execute the 3DS SDK on a system that either does not provide such features or has been modified to prevent the secure use of these features, and observe the operation of the 3DS SDK to confirm that the 3DS SDK does not execute when such features are absent or disabled.
Guidance:
String and code obfuscation tools and techniques might be sufficient to make the reverse engineering of 3DS SDK binaries impractical depending upon the implementation. Properly implemented runtime application self-protection (RASP) and/or anti-debugging techniques could also be used.
| Название | Severity | IP | Integral | |
|---|---|---|---|---|
| 1111111 111 11 1111 11111111111111111 1111111 1 11111111111111111 |
-
|
1 |
-
|
|
| 11 111111111 111 1111111111111111111111111 1111 1 11111 1111111 |
-
|
1 |
-
|
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.