What is business-logic abuse?¶
The practical answer¶
Business-logic abuse is the misuse of an application’s legitimate functions in a way that defeats the intended business process.
The key evidential caution¶
The dangerous assumption is that an attack must exploit a technical software flaw.
It may instead use the application exactly as designed, but for an unauthorised purpose.
Examples may include:
Key points¶
- repeatedly claiming a benefit
- manipulating order or refund sequences
- avoiding transaction limits
- using invitation or recovery processes improperly
- creating large numbers of accounts
- abusing promotional codes
- performing actions in an unintended order
What investigators should establish¶
Investigators should establish:
Key points¶
- the expected process
- the actual sequence of actions
- the account or session involved
- the rules applied
- what limit or control was bypassed
- the gain, loss or access obtained
- whether automation or multiple accounts were used
A technically valid request can still be abusive.
Evidential limits¶
Likewise, an unusual transaction is not automatically malicious.
Compare the activity with terms, policy, normal use, user communications and account relationships.
The evidence may sit mainly in application and business records rather than malware or network alerts.
Business-logic abuse often appears as a sequence of individually valid transactions. Preserve ordering, account relationships, device and session links, timing and any automation. The unauthorised outcome may only become visible when the complete workflow is reconstructed rather than when one request is examined alone.
Where financial or entitlement impact is alleged, link the technical sequence to the relevant business records. A manipulated request may show method, while transaction, account and loss records establish the actual unauthorised outcome.
Operational takeaway¶
Reconstruct the intended workflow and the actual action sequence, and prove how legitimate functionality was used to obtain an unauthorised result.