Authentication (AT7)
Cecilia kan brute kracht en dictionaryaanvallen gebruiken tegen een of meerdere accounts zonder limiet, of deze aanvallen worden vereenvoudigd vanwege onvoldoende complexiteit, lengte, vervaldatum en vereisten voor het gebruik van wachtwoorden, recovery-, activation-, of MFA-codes
This card relates to passwords. See AT 4 for the similar user name attacks.
Scenario: Cecilia’s Brute Force and Dictionary Attacks
Imagine a situation where Cecilia, employing brute force and dictionary attack techniques, targets the authentication system of an application. She takes advantage of:
- No Limit on Login Attempts: The system does not restrict the number of login attempts, allowing repeated guessing.
- Simplified Attacks Due to Weak Password Policies: Insufficient complexity, length, and expiration requirements make passwords easier to guess.
- Lack of Re-use Limitations: The system allows the reuse of old passwords, making it easier for attackers to regain access.
Example
Cecilia targets an online platform that lacks account lockout policies and has weak authentication requirements. She uses automated tools to repeatedly attempt logins on various accounts, trying combinations from commonly used passwords and dictionary words. Due to the absence of complexity and length requirements for passwords, and no system to detect or block repeated failed attempts, she eventually succeeds in guessing the correct credentials for several accounts.
Threat Modeling
STRIDE
The scenario falls under STRIDE: Spoofing.
Spoofing is about pretending to be another user or system. In brute force, dictionary, or credential stuffing attacks, the attacker’s entire goal is to gain access by impersonating a valid user with guessed or stolen credentials. The root weakness here is inadequate authentication protections (no lockouts, weak password policy), which makes spoofing identities feasible.
What can go wrong?
This type of vulnerability exposes users to account takeover, data breaches, and potentially, the compromise of the entire system. Threats includes credential cracking (identifying valid login credentials by trying different values for usernames and/or passwords) and credential stuffing (mass log in attempts used to verify the validity of stolen username/password pairs).
For more things that can go wrong, see the Common Attack Patterns related to this card in the table below.
What are we going to do about it?
Attacks should be prevented from being able to obtain valid account credentials by using the application in an unintended manner.
- Implement a strict account lockout policy after a certain number of failed login attempts to prevent brute force attacks.
- Enforce strong password policies, including minimum length, complexity, and expiration requirements.
- Prohibit the reuse of previous passwords to enhance security against repeated attack attempts.
For detailed advice on how to mitigate threats related to the card, see the ASVS and OWASP Developer Guide requirements in the table below.
Mappings
OWASP ASVS (v5.0): 6.1.1,6.1.2,6.2.1,6.2.2,6.2.4,6.2.5,6.2.8,6.2.9,6.2.10,6.2.11,6.2.12,6.3.1,6.3.2,6.3.3,6.3.5,6.3.8,6.4.1,6.4.2,6.4.3,6.5.1,6.5.2,6.5.3,6.5.4,6.5.5,6.6.3,6.6.4,16.3.1,16.3.3
OWASP DevGuide: A4,A12,A18,A19,A20,A21,P4,ACM1
STRIDE: Spoofing
SAFECode™: 27
CAPEC Map
| Code | Title | ASVS |
|---|---|---|
| 2 | Inducing Account Lockout | 6.1.1,6.3.1,6.3.8,16.3.1,16.3.3 |
| 49 | Password Brute Forcing | 6.1.1,6.1.2,6.2.1,6.2.4,6.2.5,6.2.8,6.2.9,6.2.10,6.2.11,6.2.12,6.3.1,6.3.2,6.3.3,6.3.5,6.3.8,6.4.1,6.4.2,6.4.3,6.5.1,6.5.2,6.5.3,6.5.4,6.5.5,6.6.3,6.6.4,16.3.1,16.3.3 |
ASVS (5.0) Cheat Sheet Series Index
Password Guessing/Brute Force Attacks
