{"title":"AES-ECB Mode Information Leakage","language":"Python","severity":"Medium","cwe":"CWE-327","source_lines":[11],"flow_lines":[11,12,13,5,6],"sink_lines":[6],"vulnerable_code":"from Crypto.Cipher import AES\nimport base64\n\ndef secure_iot_telemetry(sensor_readings):\n    device_key = b'IoTMaster2024Key'\n    cipher = AES.new(device_key, AES.MODE_ECB)\n    padded_data = sensor_readings + b' ' * (16 - len(sensor_readings) % 16)\n    encrypted_telemetry = cipher.encrypt(padded_data)\n    return base64.b64encode(encrypted_telemetry).decode('utf-8')\n\ndef transmit_batch_sensors(temp, humidity, pressure):\n    payload = f\"TEMP:{temp}|HUM:{humidity}|PRES:{pressure}\".encode()\n    encrypted_payload = secure_iot_telemetry(payload)\n    return {\"device_id\": \"sensor_node_47\", \"data\": encrypted_payload}","explanation":"The code uses AES in ECB (Electronic Codebook) mode, which encrypts identical plaintext blocks to identical ciphertext blocks. This allows attackers to detect patterns in sensor data (e.g., repetitive temperature readings) by observing repeated ciphertext blocks, leaking information about the plaintext without decrypting it.","remediation":"The fix replaces AES-ECB mode with AES-CBC mode, which uses an Initialization Vector (IV) to ensure that identical plaintext blocks produce different ciphertext blocks. A random 16-byte IV is generated for each encryption operation and prepended to the ciphertext so the receiver can extract it for decryption, preventing pattern detection from repeated sensor readings.","secure_code":"from Crypto.Cipher import AES\nfrom Crypto.Random import get_random_bytes\nimport base64\n\ndef secure_iot_telemetry(sensor_readings):\n    device_key = b'IoTMaster2024Key'\n    iv = get_random_bytes(16)\n    cipher = AES.new(device_key, AES.MODE_CBC, iv=iv)\n    padded_data = sensor_readings + b' ' * (16 - len(sensor_readings) % 16)\n    encrypted_telemetry = cipher.encrypt(padded_data)\n    return base64.b64encode(iv + encrypted_telemetry).decode('utf-8')\n\ndef transmit_batch_sensors(temp, humidity, pressure):\n    payload = f\"TEMP:{temp}|HUM:{humidity}|PRES:{pressure}\".encode()\n    encrypted_payload = secure_iot_telemetry(payload)\n    return {\"device_id\": \"sensor_node_47\", \"data\": encrypted_payload}"}