Authentication (AT4)

This card relates to the lack of anti-automation measures. See AT 7 for the similar password cracking (brute forcing, dictionary attacks, guessing, credential stuffing, credential cracking).

Scenario: Sebastien’s Username Enumeration

Visualize a scenario where Sebastien, using simple techniques, can easily identify or enumerate user names in a system. This can occur due to:

1. Predictable Usernames: The system uses easily guessable or standard formats for usernames.
2. Informative Error Messages: Error messages on login pages reveal whether a username exists or not.
3. User Enumeration through Other Features: Features like 'Forgot Password' or 'Sign Up' inadvertently confirm the existence of specific usernames.

Example

Sebastien enumerates the usernames of a company by compiling a list of employees from publicly available sources such as LinkedIn. He then applies the general pattern " firstname.lastname'@'company.com " to generate potential email addresses, which are often used as usernames. Setting the stage for further attacks like password guessing or phishing.

Threat Modeling

STRIDE

The scenario maps directly to STRIDE: Information Disclosure.

Sebastien is learning something the system should treat as sensitive: the set of valid usernames. In STRIDE, Information Disclosure is about exposing data to unauthorized parties. Usernames are part of authentication secrets, and leaking or allowing enumeration discloses information attackers can weaponize.

What can go wrong?

Such vulnerabilities can lead to targeted attacks, including phishing, social engineering, and brute-force attacks, as attackers gain knowledge about valid user accounts.

The threat is often the result of one or more of the following:

1. User names (IDs, account names) may be guessable, published elsewhere, or are simply email addresses
2. Authentication and related mechanisms may indicate whether a username is valid or not (registration, password reset/recovery, username recovery, change password, change email address)
3. Missing authentication failure detection
4. Missing monitoring to identify attacks against multiple user accounts, utilizing the same password
5. Additionally another web or non-web application (e.g. mobile app, telephone service) that utilizes the same credentials has one or more of the above problems.

For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.

What are we going to do about it?

1. Avoid using predictable username formats. Encourage or enforce more complex and less guessable usernames.
2. Design error messages to be non-revealing, providing the same response regardless of whether the username exists or not.
3. Implement measures to prevent enumeration through account-related features, ensuring they do not disclose information about the existence of usernames.

For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.