Case Study: External Penetration Test for a Singapore-based cross-border remittance provider

15 January 2024

---

Introduction

This case study details the findings of an external penetration test conducted by Ssquad for a cross-border remittance provider based out of Singapore, a leading remittance service provider catering to both businesses and individual consumers. The primary focus was to identify and assess potential security vulnerabilities within the remittance provider’s externally facing systems, networks, and web applications.

Scope of Testing

The remittance provider operates in the B2B and B2C sectors, handling delicate financial data. To ensure comprehensive coverage, our focus is on the company's external systems, networks, and web applications accessible through the Internet. The external penetration test focused on the following aspects of the customer’s online infrastructure:

Methodologies Employed

A combination of automated and manual techniques were utilized during the penetration test, including:

Vulnerability Findings

Our penetration test revealed several critical vulnerabilities within customer’s online infrastructure:

• Weak Authentication Mechanisms: Outdated protocols and weak password policies made user accounts susceptible to credential stuffing and brute-force attacks.


• Unpatched Software: Several systems and applications were identified as running outdated versions with known vulnerabilities, potentially exposing them to remote code execution attacks.


• Exposed Sensitive Data: Customer information, including financial details and personal data, was found to be stored unencrypted or accessible through insecure APIs.


• Insufficient Input Validation: Vulnerabilities in user input validation allowed for potential SQL injection attacks and manipulation of application logic.


• Network Misconfigurations: Exposed services and open ports on network devices created potential attack vectors for malicious actors.

Remediation Actions

Following our penetration test, the customer promptly implemented the following remediation measures:

• Patch Management: All vulnerable systems and applications were immediately updated with the latest security patches.


• Enhanced Authentication: Multi-factor authentication was implemented for user logins, and stronger password policies were enforced.


• Data Encryption and Access Controls: Sensitive data was encrypted at rest and in transit, and access controls were strengthened to restrict unauthorized access.


• API Security: APIs were secured through authentication, authorization, and input validation measures to prevent unauthorized access and data manipulation.


• Network Security Review: Network devices were reviewed and configured securely, closing unnecessary ports and services.

Conclusion

Ssquad’s external penetration test played a crucial role in identifying and addressing critical vulnerabilities within the remittance provider’s online infrastructure. By implementing prompt and comprehensive remediation measures, the remittance provider significantly enhanced its security posture and mitigated potential risks to customer data. This proactive approach demonstrates the provider's commitment to the security and privacy of its customers, fostering trust and confidence in its remittance services.

Additional Recommendations

• Regular Penetration Testing: Conduct periodic penetration tests to identify and address emerging vulnerabilities.


• Security Awareness Training: Train employees on cybersecurity best practices to minimize human error risks.


• Security Incident Response Plan: Develop a well-defined incident response plan to effectively manage and respond to cyberattacks.


• Continuous Monitoring: Implement security monitoring tools and processes to detect and respond to suspicious activities in real time.

By implementing these additional recommendations, the remittance provider can further strengthen its security posture and maintain a proactive approach to protecting its customers and their information.