A Theoretical Review of Mitigation Techniques for Thick Client Application Vulnerabilities

The popularity and usefulness of the thick applications make them a prime target for attackers. We have seen in our previous paper different types of attacks that an adversary can make use of to access a user's data through a desktop application. For example, a successful data dumping from memory, or registry can greatly be significant for the malicious person since he may obtain clear-text credentials of the previously logged users. This possible critical scenario motivated IT security engineers and researchers to look for various preventive techniques to narrow down the chance of attackers performing this kind of activity. This paper will elaborate on the recommendations that mitigate the exploitation of different vulnerabilities in desktop applications. We will also take into account the impact of the most well-known thick client vulnerabilities, as well as the misconfiguration concept that may lead to abuse. On this, we will orientate the paper on how a penetration testing phase can help find current issues from a given executable application before a malicious person does.