| fullrecord |
[{"key": "dc.contributor.advisor", "value": "Semenov, Alexander", "language": "", "element": "contributor", "qualifier": "advisor", "schema": "dc"}, {"key": "dc.contributor.author", "value": "Laitinen, Pentti", "language": null, "element": "contributor", "qualifier": "author", "schema": "dc"}, {"key": "dc.date.accessioned", "value": "2018-04-24T17:11:14Z", "language": "", "element": "date", "qualifier": "accessioned", "schema": "dc"}, {"key": "dc.date.available", "value": "2018-04-24T17:11:14Z", "language": "", "element": "date", "qualifier": "available", "schema": "dc"}, {"key": "dc.date.issued", "value": "2018", "language": null, "element": "date", "qualifier": "issued", "schema": "dc"}, {"key": "dc.identifier.other", "value": "oai:jykdok.linneanet.fi:1869444", "language": null, "element": "identifier", "qualifier": "other", "schema": "dc"}, {"key": "dc.identifier.uri", "value": "https://jyx.jyu.fi/handle/123456789/57739", "language": "", "element": "identifier", "qualifier": "uri", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Web-sovellukset ovat suosittu kohde pahansuoville hy\u00f6kk\u00e4yksille. Yleisiss\u00e4 web-sovelluksista voi l\u00f6yty\u00e4 useita haavoittuvuuksia vuoden aikana, joten on t\u00e4rke\u00e4\u00e4 p\u00e4ivitt\u00e4\u00e4 sovelluksia aktiivisesti, jos niihin tulee tietoturvap\u00e4ivityksi\u00e4. Harvoin n\u00e4iss\u00e4 sovelluksissa on kuitenkaan automaattisia p\u00e4ivityksi\u00e4, joten j\u00e4rjestelmien p\u00e4ivitt\u00e4minen on usein k\u00e4ytt\u00e4j\u00e4n harteilla. Jos j\u00e4rjestelm\u00e4 joutuu hy\u00f6kk\u00e4yksen kohteeksi, sit\u00e4 ei pelk\u00e4st\u00e4\u00e4n saateta k\u00e4ytt\u00e4\u00e4 sivuston omistajaa vastaan, vaan my\u00f6s aiheuttamaan haittaa sen k\u00e4ytt\u00e4jille. Mik\u00e4li web-sovellusten p\u00e4ivitystavat olisivat paremmin tiedossa, voitaisiin p\u00e4ivitysk\u00e4yt\u00e4nt\u00f6j\u00e4 parantaa t\u00e4m\u00e4n tiedon pohjalta.\r\n\r\nTutkielman tavoitteena on muodostaa menetelm\u00e4 internetin laajuiseen web-sovellusten haavoittuvuuteen liittyv\u00e4n metainformaation tiedonkeruuseen. Metodia tullaan testaamaan WordPress-sovellusta vastaan, joka on yksi suosituimmista avoimen l\u00e4hdekoodin web-sovelluksista. Menetelm\u00e4 on artefakti, joka kehitet\u00e4\u00e4n noudattaen kuusi askelta k\u00e4sitt\u00e4v\u00e4\u00e4 suunnittelutieteen (Design Science) metodologiaa.\r\n\r\nTutkimuksen yhteydess\u00e4 tehd\u00e4\u00e4n kaksi kirjallisuuskatsausta. Ensimm\u00e4inen kirjallisuuskatsaus on toteutettu web-sovelluksia k\u00e4sittelev\u00e4n tietoturvakirjallisuuden pohjalta ja se keskittyy yleisemm\u00e4ll\u00e4 tasolla web-sovelluksiin. T\u00e4m\u00e4n katsauksen avulla pyrit\u00e4\u00e4n hahmottamaan, millaisia riskej\u00e4 ja hy\u00f6kk\u00e4yksi\u00e4 vastaavat sovellukset yleens\u00e4 kohtaavat. Toinen kirjallisuuskatsaus keskittyy web-sovellusten haavoittuuksien skannaukseen, mink\u00e4 avulla on mahdollista arvioida paremmin ovatko nykyiset ratkaisut sopivia koko verkon kattavaan tiedonkeruuseen.\r\n\r\nKirjallisuuskatsausten pohjalta tutkimuksessa muodostetaan menetelm\u00e4 Internetin laajalle web-sovellusten informaation keruulle. Metodin testauksen ja arvioinnin tuloksena voidaan todeta, ett\u00e4 modernit laajennettavat ZMap projektin luomat avoimeinl\u00e4hdekoodin ty\u00f6kalut ovat nopeita ja tehokkaita laaja-alaiseen skannaukseen ja informaation keruuseen. Censys projekti k\u00e4ytt\u00e4\u00e4 ZMap-ty\u00f6kalua aktiivisesti datan keruuseen tutkimuksia varten. T\u00e4ss\u00e4 tutkimuksessa k\u00e4ytet\u00e4\u00e4n Censys projektin ker\u00e4\u00e4m\u00e4\u00e4 dataa apuna metodin testauksessa. Testeiss\u00e4 saatujen tuloksien perusteella on p\u00e4\u00e4telt\u00e4viss\u00e4, ett\u00e4 varsin suurella osalla WordPress-asennuksista oli k\u00e4yt\u00f6ss\u00e4 yli vuoden vanha versio sovelluksesta. Asennettujen versioiden tuoreudessa oli havaittavissa pieni\u00e4 viitteit\u00e4 siit\u00e4, ett\u00e4 joillain mantereilla sijaitsevat asennukset olivat astetta tuoreempia kuin toisilla. Sill\u00e4 oliko web-sovelluksen web-sivulle asennettu sertifikaatti, ei n\u00e4ytt\u00e4nyt olevan juurikaan vaikutusta sovelluksen version tuoreuteen.", "language": "fi", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.abstract", "value": "Web applications are a popular target for malicious attacks. Common web applications can have multiple different security flaws discovered within a timespan of a year. It is important and useful practice to keep these applications up to date to avoid possible exploitation of these flaws, but rarely these systems have great automatic update systems built in, so the maintenance tasks fall to the users. If system is hacked by a malicious party it might not only be used to harm the owner of the system but to also harm other parties. Knowing the current installation base of specific web applications allows reacting to possible problems within the patching practises. \r\n\r\nThis study aims to construct a method for collecting meta information regarding vulnerable web applications at Internet-wide scale. Web content management system WordPress has been chosen for the testing application of this method as it is one of the most popular open source web application used today. Construction process of this information gathering method followed the six steps of the Design Science Research Methodology. Web content management system (WCMS) security literature has been reviewed within this study, to gain knowledge of vulnerabilities and risks that WCMS applications face. These results are then compared to the vulnerabilities and risks facing other common web applications. Second literature review covers previous reputable studies comparing and discussing vulnerability scanning. The information gained from this second literature review allows us to understand how applicable these methods presented in vulnerability scanning literature are to large scale scanning.\r\n\r\nWith knowledge gained from these literature reviews a scanning method was created and tested. The testing proved that new kind of extendable open source scanning tools created by The ZMap Project are fast and efficient for internet wide web application information gathering. The Censys project actively uses ZMap to gather research data from internet. This study uses the research data collected by Censys for testing of the constructed method. The data gained from the testing showed that there are still quite many hosts which had over a year old versions of WordPress running. The results allowed exploration of the installation age differences between continents, but these differences were quite small. Web applications which had digital certificate installed had slightly more recent versions of WordPress installed, compared to the sites which had no certificate.", "language": "en", "element": "description", "qualifier": "abstract", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted using Plone Publishing form by Pentti Laitinen (peyrenla) on 2018-04-24 17:11:13.471697. Form: Pro gradu -lomake (https://kirjasto.jyu.fi/julkaisut/julkaisulomakkeet/pro-gradu-lomake). JyX data: [jyx_publishing-allowed (fi) =True]", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Submitted by jyx lomake-julkaisija (jyx-julkaisija.group@korppi.jyu.fi) on 2018-04-24T17:11:14Z\r\nNo. of bitstreams: 2\r\nURN:NBN:fi:jyu-201804242355.pdf: 1077795 bytes, checksum: cc015757e90fcc30cd8e894ad1fc1a8a (MD5)\r\nlicense.html: 4835 bytes, checksum: f8fd0e61177800b24e14a32688a39061 (MD5)", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.description.provenance", "value": "Made available in DSpace on 2018-04-24T17:11:14Z (GMT). No. of bitstreams: 2\r\nURN:NBN:fi:jyu-201804242355.pdf: 1077795 bytes, checksum: cc015757e90fcc30cd8e894ad1fc1a8a (MD5)\r\nlicense.html: 4835 bytes, checksum: f8fd0e61177800b24e14a32688a39061 (MD5)\r\n Previous issue date: 2018", "language": "en", "element": "description", "qualifier": "provenance", "schema": "dc"}, {"key": "dc.format.extent", "value": "1 verkkoaineisto (75 sivua)", "language": null, "element": "format", "qualifier": "extent", "schema": "dc"}, {"key": "dc.format.mimetype", "value": "application/pdf", "language": null, "element": "format", "qualifier": "mimetype", "schema": "dc"}, {"key": "dc.language.iso", "value": "eng", "language": null, "element": "language", "qualifier": "iso", "schema": "dc"}, {"key": "dc.rights", "value": "In Copyright", "language": "en", "element": "rights", "qualifier": null, "schema": "dc"}, {"key": "dc.subject.other", "value": "haavoittuvuus", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "tietoturva", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "web-sovellukset", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "haavoittuvuusskannaus", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "web-indeksointi", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "suunnittelutiede", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.subject.other", "value": "web-sis\u00e4ll\u00f6n hallintaj\u00e4rjestelm\u00e4", "language": "", "element": "subject", "qualifier": "other", "schema": "dc"}, {"key": "dc.title", "value": "Vulnerabilities in the wild : detecting vulnerable web applications at scale", "language": null, "element": "title", "qualifier": null, "schema": "dc"}, {"key": "dc.title.alternative", "value": "Detecting vulnerable web applications at scale", "language": null, "element": "title", "qualifier": "alternative", "schema": "dc"}, {"key": "dc.type", "value": "master thesis", "language": null, "element": "type", "qualifier": null, "schema": "dc"}, {"key": "dc.identifier.urn", "value": "URN:NBN:fi:jyu-201804242355", "language": null, "element": "identifier", "qualifier": "urn", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Master\u2019s thesis", "language": "en", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.type.ontasot", "value": "Pro gradu -tutkielma", "language": "fi", "element": "type", "qualifier": "ontasot", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Faculty of Information Technology", "language": "en", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.faculty", "value": "Informaatioteknologian tiedekunta", "language": "fi", "element": "contributor", "qualifier": "faculty", "schema": "dc"}, {"key": "dc.contributor.department", "value": "Informaatioteknologia", "language": "fi", "element": "contributor", "qualifier": "department", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "University of Jyv\u00e4skyl\u00e4", "language": "en", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.contributor.organization", "value": "Jyv\u00e4skyl\u00e4n yliopisto", "language": "fi", "element": "contributor", "qualifier": "organization", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Information Systems Science", "language": "en", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.subject.discipline", "value": "Tietoj\u00e4rjestelm\u00e4tiede", "language": "fi", "element": "subject", "qualifier": "discipline", "schema": "dc"}, {"key": "dc.date.updated", "value": "2018-04-24T17:11:14Z", "language": "", "element": "date", "qualifier": "updated", "schema": "dc"}, {"key": "yvv.contractresearch.funding", "value": "0", "language": "", "element": "contractresearch", "qualifier": "funding", "schema": "yvv"}, {"key": "dc.type.coar", "value": "http://purl.org/coar/resource_type/c_bdcc", "language": null, "element": "type", "qualifier": "coar", "schema": "dc"}, {"key": "dc.rights.accesslevel", "value": "openAccess", "language": "fi", "element": "rights", "qualifier": "accesslevel", "schema": "dc"}, {"key": "dc.type.publication", "value": "masterThesis", "language": null, "element": "type", "qualifier": "publication", "schema": "dc"}, {"key": "dc.subject.oppiainekoodi", "value": "601", "language": null, "element": "subject", "qualifier": "oppiainekoodi", "schema": "dc"}, {"key": "dc.subject.yso", "value": "haavoittuvuus", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "tietoturva", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "sovellukset (tietotekniikka)", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "indeksointi", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.subject.yso", "value": "hallintaj\u00e4rjestelm\u00e4t", "language": null, "element": "subject", "qualifier": "yso", "schema": "dc"}, {"key": "dc.format.content", "value": "fulltext", "language": null, "element": "format", "qualifier": "content", "schema": "dc"}, {"key": "dc.rights.url", "value": "https://rightsstatements.org/page/InC/1.0/", "language": null, "element": "rights", "qualifier": "url", "schema": "dc"}, {"key": "dc.type.okm", "value": "G2", "language": null, "element": "type", "qualifier": "okm", "schema": "dc"}]
|