Instructor: Authentication attacks. 2 2
In this lesson, 3 3
we are going to talk about authentication attacks 4 4
and what you can do to prevent them. 5 5
We're going to talk about things like spoofing, 6 6
On-Path attacks, password spraying, credential stuffing 7 7
and broken authentication, as well as several others. 8 8
Now, when we talk about spoofing, 9 9
this is a software based attack 10 10
where the goal is to assume the identity of a user, 11 11
a process, an address or other unique identifier. 12 12
Spoofing has used a lot to try to bypass authentication 13 13
and be able to present yourself as if you're somebody else. 14 14
Now, one of the things attackers love to try is 15 15
an On-path attacks. 16 16
Now, an On-path attack is attack where the attacker 17 17
is going to sit between two communicating hosts 18 18
and transparently captures, monitors 19 19
and relays the communications between those hosts. 20 20
Now, we've talked about an On-Path attack before 21 21
but essentially if you're on a wireless network, 22 22
somebody could be sniffing the air, capturing those packets 23 23
and then being a man in the middle, 24 24
they can capture what's being said. 25 25
Now, if they put themselves directly 26 26
in the middle of the communication, 27 27
you might be connecting to them 28 28
and they would be connecting to the server 29 29
and they're listening to everything you say. 30 30
They can capture it moderate and relay it right on 31 31
or they could even modify it if they wanted to. 32 32
Now, a variation on this 33 33
is what's known as a man-in-the-browser. 34 34
This is an MitB. 35 35
This is an attack that intercepts the API calls 36 36
between the browser process and its DLLs. 37 37
And so if you're attacking the network 38 38
or between two clients who are a client and a server, 39 39
you're on-path attack. 40 40
If you're using the browser to do it, 41 41
you're a man-in-the-browser. 42 42
Now, one of the things that people love to try to do 43 43
is break passwords because if they can get your password 44 44
they can own your system, right? 45 45
Well, let's talk about the way passwords work for a moment. 46 46
This will be a quick review from security plus. 47 47
Now, when you take a password and you go to store it, 48 48
do you store it in the database as the word password? 49 49
No, you actually hash it first. 50 50
So it's going to be an MD5 hash 51 51
or a SHA-1 hash or a SHA-256 hash 52 52
and it's going to be able to be stored in that database 53 53
as that hash so, nobody knows what that actual password is, 54 54
not even the system administrator in theory. 55 55
Now, this means that that password cannot be recoverable 56 56
'cause you can't go from the hash back to the original. 57 57
So when the user chooses that password, 58 58
we're going to make sure we hash it 59 59
using that cryptographic function 60 60
anytime we store it to our database. 61 61
This will help protect our users 62 62
inside our web applications. 63 63
Now, even though we do that, 64 64
a lot of people are still going to try to guess your password. 65 65
Now there's a lot of different ways that they try to do this 66 66
and one of the most common 67 67
is what's known as an online password attack. 68 68
This involves somebody simply trying to guess 69 69
what your password is 70 70
and entering it directly to the service. 71 71
Think about this way, 72 72
I want to log into Facebook as if I was you. 73 73
I know your username because it's tied to your email. 74 74
So, I type in your email address 75 75
and I start typing in passwords and try hitting login. 76 76
Each time I do that, I'm doing an online password attack. 77 77
I'm guessing passwords over and over and over again 78 78
until I get in. 79 79
Now, this is the idea of how you can do 80 80
an online password attack. 81 81
Now how can you, as an analyst identify 82 82
that that's what's going on? 83 83
Well, you can look at the logs. 84 84
If you look at your audit logs, 85 85
you should see something that looks like this. 86 86
Here, somebody was trying to log in as Jason. 87 87
They tried at 1912 and they tried using the word password. 88 88
Then they tried 1913 using pass1234. 89 89
Then they tried 1914, puppy123; 1915 cupcake; 90 90
1916 admin; 1917 admin123. 91 91
And so this is an example 92 92
of when you see somebody trying to do 93 93
an online password attack. 94 94
They're basically going in 95 95
and logging in as if they were you just like you would 96 96
except they're using the wrong password 97 97
'cause they don't know yours yet. 98 98
This can be useful if you know the person 99 99
and if you're an attacker who has some knowledge 100 100
about that person 101 101
and can try to guess something that they might be thinking. 102 102
But otherwise, it's a pretty inefficient way of doing it. 103 103
Now to prevent this type of an attack from happening, 104 104
there's really a couple things you can do. 105 105
You can restrict the number or the rate of login attempts 106 106
to prevent these online password attacks. 107 107
So, you can lock the account after three incorrect attempts 108 108
where they have to reset their password or contact security. 109 109
That would be one way to do it 110 110
or you could say you can only log in three times 111 111
and if you get it wrong, 112 112
you have to wait 20 minutes and then it would reset again. 113 113
That's limiting the rate of it. 114 114
And so these are different ways that you can do this. 115 115
Now, another way that people will try 116 116
to break into your password is by doing password spraying. 117 117
This is a brute force type of attack 118 118
in which multiple user accounts are tested 119 119
with a dictionary of common passwords. 120 120
So, here's an example of this, 121 121
going from 1912 to 1917 again. 122 122
Notice the first two attempts were against Jason. 123 123
They tried password and pass123. 124 124
The second two attempts were against Tim using again, 125 125
password and password123. 126 126
The third attempt was against Tamera, 127 127
password and password123. 128 128
Notice the difference here. 129 129
We have groupings of the same passwords 130 130
that are common words from a dictionary 131 131
being tried over and over again against different accounts. 132 132
This makes it password spraying 133 133
instead of an online password attack. 134 134
Now the last one we're going to talk about here 135 135
is credential stuffing. 136 136
Now, credential stuffing is another type 137 137
of brute force attack. 138 138
In this one, they're going to try to take 139 139
stolen user account names and passwords 140 140
and test them against multiple websites. 141 141
So, let's say there was a new story 142 142
and there was a new data breach that happened 143 143
and Facebook got hacked, 144 144
and now, all of Facebook's username and passwords are known. 145 145
So everybody knows what the usernames are 146 146
which are emails and the passwords. 147 147
Now, Facebook is going to make everybody go in 148 148
and change their passwords, right? 149 149
So you're not going to be able to get back into Facebook 150 150
but they could take that username and password 151 151
and try it on Gmail or Yahoo or MSN or some other website. 152 152
And by going across to different websites, 153 153
you can try doing this credential stuffing 154 154
because you know it was a valid username and password 155 155
on one system. 156 156
It may be on others 157 157
because people tend to reuse your user and passwords. 158 158
So, how do you prevent credential stuffing? 159 159
Well, credential stuffing can be prevented 160 160
by not reusing passwords across these different websites. 161 161
Now, the next thing we want to talk about 162 162
is broken authentication. 163 163
Broken authentication is a software vulnerability 164 164
where the authentication mechanisms 165 165
allow the attacker to gain entry. 166 166
Essentially, the coders did a really bad job. 167 167
Now, when this happens, you can have bad things happen 168 168
like displaying clearex credentials 169 169
using weak session tokens 170 170
or permitting brute force login requests. 171 171
Now, what causes these type of things? 172 172
Well, weak password credentials for one. 173 173
Let's say, you built a system 174 174
and you said all passwords will be four digits long. 175 175
That's a pretty weak system. 176 176
There's only a thousand variations 177 177
so people could brute force their way in. 178 178
Another thing that would happen is 179 179
if you had weak password reset methods. 180 180
So you're going to use something like knowledge factors 181 181
that are tied to things that people could easily look up. 182 182
What is your birthday? 183 183
Where were you born? 184 184
What state are you registered to vote in? 185 185
These are all weak things 186 186
because most of this information is stuff 187 187
you can find online about people 188 188
so we wouldn't want to use those type of things. 189 189
Next, you have credential exposure. 190 190
Now, credential exposures when the app 191 191
actually exposes the credentials 192 192
or the authentication tokens 193 193
to somebody who's in the middle, 194 194
so if we have a man in the middle. 195 195
Now, this is really bad 196 196
because a lot of applications will hard code credentials 197 197
into the application, or they're not using encryption 198 198
so they're sending things across the network in plain text 199 199
or they're using weak encryption, 200 200
and so because they're using weak encryption, 201 201
it can be cracked. 202 202
These are all things 203 203
that can lead to this credential exposure. 204 204
And then finally, we have session hijacking. 205 205
This is when the application is vulnerable 206 206
to session hijacking 207 207
because maybe you're using session keys 208 208
that just aren't really strong 209 209
and they're really easy to guess. 210 210
And so that's an easy way for people to guess that session, 211 211
jump into it, hijack it 212 212
and then get the information they want.