Improving Web Application Security: Threats and - CGISecurity

30 Part I: Introduction to Threats and CountermeasuresBrute Force AttacksBrute force attacks rely on computational power to crack hashed passwords or othersecrets secured with hashing and encryption. To mitigate the risk, use strongpasswords.Dictionary AttacksThis attack is used to obtain passwords. Most password systems do not storeplaintext passwords or encrypted passwords. They avoid encrypted passwordsbecause a compromised key leads to the compromise of all passwords in the datastore. Lost keys mean that all passwords are invalidated.Most user store implementations hold password hashes (or digests). Users areauthenticated by re-computing the hash based on the user-supplied password valueand comparing it against the hash value stored in the database. If an attackermanages to obtain the list of hashed passwords, a brute force attack can be used tocrack the password hashes.With the dictionary attack, an attacker uses a program to iterate through all of thewords in a dictionary (or multiple dictionaries in different languages) and computesthe hash for each word. The resultant hash is compared with the value in the datastore. Weak passwords such as “Yankees” (a favorite team) or “Mustang”(a favorite car) will be cracked quickly. Stronger passwords such as“?You’LlNevaFiNdMeyePasSWerd!”, are less likely to be cracked.Note Once the attacker has obtained the list of password hashes, the dictionary attack can beperformed offline and does not require interaction with the application.Countermeasures to prevent dictionary attacks include:●●Use strong passwords that are complex, are not regular words, and contain amixture of upper case, lower case, numeric, and special characters.Store non-reversible password hashes in the user store. Also combine a salt value(a cryptographically strong random number) with the password hash.For more information about storing password hashes with added salt, see Chapter 14,“Building Secure Data Access.”