2KKUU7ita

298
Part V: Hacking Applications
Figure 14-12:
A network
camera’s
login credentials
embedded
directly in
its HTML
source
code.
Countermeasures against
unsecured login systems
You can implement the following countermeasures to prevent people from
attacking weak login systems in your web applications:
✓ Any login errors that are returned to the end user should be as generic
as possible, saying something similar to Your user ID and password
combination is invalid.
✓ The application should never return error codes in the URL that differentiate
between an invalid user ID and an invalid password.
If a URL message must be returned, the application should keep it as
generic as possible. Here’s an example:
www.your_web_app.com/login.cgi?success=false
This URL message might not be convenient to the user, but it helps hide
the mechanism and the behind-the-scenes actions from the attacker.